CVE-2025-30133

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-30133
An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the "IROAD X View" app for authentication, but its HTTP server lacks this restriction. Once connected to the dashcam's Wi-Fi network via the default password ("qwertyuiop"), an attacker can directly access the HTTP server at http://192.168.10.1 without undergoing the pairing process. Additionally, no alert is triggered on the device when an attacker connects, making this intrusion completely silent.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/geo-chen/IROAD/blob/main/README.md#finding-12---cve-2025-30133-unprotected-url-shortcut Third Party Advisory
https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-7-bypass-of-device-pairingregistration-for-iroad-fx2 Third Party Advisory
https://www.iroadau.com.au/downloads/ Product
https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-7-bypass-of-device-pairingregistration-for-iroad-fx2 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:iroadau:fx2_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:iroadau:fx2:-:*:*:*:*:*:*:*
History

06 Nov 2025, 20:07

Type Values Removed Values Added
First Time Iroadau fx2
Iroadau
Iroadau fx2 Firmware
CPE cpe:2.3:h:iroadau:fx2:-:*:*:*:*:*:*:*
cpe:2.3:o:iroadau:fx2_firmware:-:*:*:*:*:*:*:*
References () https://github.com/geo-chen/IROAD/blob/main/README.md#finding-12---cve-2025-30133-unprotected-url-shortcut - () https://github.com/geo-chen/IROAD/blob/main/README.md#finding-12---cve-2025-30133-unprotected-url-shortcut - Third Party Advisory
References () https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-7-bypass-of-device-pairingregistration-for-iroad-fx2 - () https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-7-bypass-of-device-pairingregistration-for-iroad-fx2 - Third Party Advisory
References () https://www.iroadau.com.au/downloads/ - () https://www.iroadau.com.au/downloads/ - Product

30 Jul 2025, 16:15

Type Values Removed Values Added
References () https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-7-bypass-of-device-pairingregistration-for-iroad-fx2 - () https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-7-bypass-of-device-pairingregistration-for-iroad-fx2 -
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-284

29 Jul 2025, 14:14

Type Values Removed Values Added
Summary
  • (es) Se detectó un problema en IROAD Dashcam FX2 devices. Es posible que se omita el emparejamiento/registro del dispositivo. Requiere el registro del dispositivo mediante la aplicación "IROAD X View" para la autenticación, pero su servidor HTTP no tiene esta restricción. Una vez conectado a la red Wi-Fi de la cámara de salpicadero con la contraseña predeterminada ("qwertyuiop"), un atacante puede acceder directamente al servidor HTTP en http://192.168.10.1 sin realizar el proceso de emparejamiento. Además, no se activa ninguna alerta en el dispositivo cuando un atacante se conecta, lo que hace que esta intrusión sea completamente silenciosa.

28 Jul 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-28 14:15

Updated : 2025-11-06 20:07

NVD link : CVE-2025-30133

Mitre link : CVE-2025-30133

CVE.ORG link : CVE-2025-30133

JSON object : View

Products Affected

iroadau

  • fx2
  • fx2_firmware
CWE
CWE-284

Improper Access Control