CVE-2025-2347
📋 TL;DR
The IROAD Dash Cam FX2 uses a default password 'qwertyuiop' during device registration, allowing attackers on the same local network to bypass authentication. This affects all IROAD FX2 dash cams with firmware up to March 8, 2025. Attackers can potentially pair with and control vulnerable dash cams.
💻 Affected Systems
- IROAD Dash Cam FX2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full control of dash cam, accesses video footage, disables recording, or tampers with device settings while remaining undetected.
Likely Case
Unauthorized pairing with dash cam allowing access to live video feed and recorded footage from within the local network.
If Mitigated
Limited to network reconnaissance if proper network segmentation and access controls prevent local network access.
🎯 Exploit Status
Exploit details publicly disclosed on GitHub; requires attacker on same network but no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Monitor IROAD website for firmware updates addressing CVE-2025-2347.
🔧 Temporary Workarounds
Network Segmentation
allIsolate dash cam network from other devices using VLANs or separate network
Change Default Password
allIf device allows password change during registration, use strong unique password
🧯 If You Can't Patch
- Physically disconnect dash cam from network when not in use
- Monitor network for unauthorized pairing attempts to dash cam IP/MAC
🔍 How to Verify
Check if Vulnerable:
Check firmware version in dash cam settings; if version is 20250308 or earlier, device is vulnerable.Check Version:
Check via IROAD mobile app or device settings menu (no CLI command available)Verify Fix Applied:
Verify firmware version is newer than 20250308 after any vendor update.📡 Detection & Monitoring
Log Indicators:
- Failed registration attempts
- Successful registrations from unknown devices
- Multiple registration attempts with password 'qwertyuiop'
Network Indicators:
- UDP/TCP traffic to dash cam port 80/443 from unauthorized IPs
- ARP requests for dash cam MAC from unknown devices
SIEM Query:
source_ip!=authorized_device AND dest_ip=dash_cam_ip AND (event_description CONTAINS 'registration' OR event_description CONTAINS 'pairing')