CVE-2025-30135
📋 TL;DR
IROAD Dashcam FX2 devices lack authentication on HTTP and RTSP interfaces, allowing attackers to download stored video recordings and view live footage without credentials. This affects all users of these dashcams, exposing sensitive driving data and personal information.
💻 Affected Systems
- IROAD Dashcam FX2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all recorded video data, including sensitive locations, license plates, and personal conversations, potentially used for stalking, blackmail, or corporate espionage.
Likely Case
Unauthorized access to driving footage revealing personal routines, home/work locations, and potentially incriminating evidence from accidents or incidents.
If Mitigated
Limited exposure if devices are isolated from untrusted networks, though physical proximity attacks remain possible.
🎯 Exploit Status
Exploitation requires only web browser or RTSP client. No special tools or skills needed. Public GitHub repository demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.iroadau.com.au/downloads/
Restart Required: No
Instructions:
Check vendor website for firmware updates. If available, download and install following manufacturer instructions. No specific patch version is documented.
🔧 Temporary Workarounds
Network Isolation
allIsolate dashcam on separate VLAN or network segment without internet access
Firewall Rules
linuxBlock external access to dashcam IP addresses and ports 80, 8554
iptables -A INPUT -s 192.168.10.1 -j DROP
iptables -A INPUT -p tcp --dport 8554 -j DROP
🧯 If You Can't Patch
- Physically disconnect dashcam from networks when not in use
- Use dashcam only in trusted environments with no untrusted devices on same network
🔍 How to Verify
Check if Vulnerable:
Access http://192.168.10.1/mnt/extsd/event/ in browser or connect to rtsp://192.168.10.1:8554/live with VLC. If accessible without credentials, device is vulnerable.Check Version:
Check device settings menu or vendor documentation for firmware versionVerify Fix Applied:
Attempt same access methods after applying fixes. Successful access indicates still vulnerable.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to /mnt/extsd/event/
- Multiple RTSP connection attempts from unauthorized IPs
Network Indicators:
- Traffic to 192.168.10.1:80 or :8554 from unexpected sources
- Large data transfers from dashcam IP
SIEM Query:
source_ip="192.168.10.1" AND (dest_port=80 OR dest_port=8554) AND NOT user_agent="expected-agent"