CVE-2025-2350
📋 TL;DR
This critical vulnerability in IROAD Dash Cam FX2 allows unauthenticated attackers on the local network to upload arbitrary files, potentially leading to webshell deployment and system compromise. It affects IROAD Dash Cam FX2 devices with firmware up to March 8, 2025. Attackers must have local network access to exploit this vulnerability.
💻 Affected Systems
- IROAD Dash Cam FX2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover via webshell, enabling persistent access, data exfiltration, lateral movement within the network, and potential use as a pivot point for further attacks.
Likely Case
Unauthenticated attackers upload malicious files to gain remote code execution, compromising the dash cam and potentially accessing stored video footage.
If Mitigated
With proper network segmentation and access controls, impact is limited to the isolated dash cam device without affecting other systems.
🎯 Exploit Status
Public exploit code is available on GitHub. The vulnerability allows unrestricted file upload without authentication, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor IROAD vendor website for firmware updates addressing CVE-2025-2350.
🔧 Temporary Workarounds
Network Segmentation
allIsolate dash cam devices on a separate VLAN with strict access controls
Firewall Rules
allBlock all inbound traffic to dash cam devices except from authorized management systems
🧯 If You Can't Patch
- Segment dash cam network from critical systems using VLANs or physical separation
- Implement strict network access controls and monitor for unusual upload activity to /action/upload_file
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or device settings. If version is 20250308 or earlier, device is vulnerable.Check Version:
Check device web interface at http://[device-ip]/ or consult device documentation for version checkingVerify Fix Applied:
Verify firmware version is newer than 20250308 and test that /action/upload_file endpoint rejects unauthorized uploads.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /action/upload_file endpoint
- Unexpected process execution on dash cam device
Network Indicators:
- HTTP POST requests to /action/upload_file from unauthorized sources
- Unexpected outbound connections from dash cam devices
SIEM Query:
source_ip IN (dash_cam_ips) AND http_path:"/action/upload_file" AND http_method:POST