{"id":"CVE-2025-30133","aliases":["EUVD-2025-22908","GHSA-v9v8-8vjh-j435"],"status":"published","title":"An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can...","description":"An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the \"IROAD X View\" app for authentication, but its HTTP server lacks this restriction. Once connected to the dashcam's Wi-Fi network via the default password (\"qwertyuiop\"), an attacker can directly access the HTTP server at http://192.168.10.1 without undergoing the pairing process. Additionally, no alert is triggered on the device when an attacker connects, making this intrusion completely silent.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00573,"percentile":0.47629,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2025-07-28T00:00:00Z","modified":"2026-06-17T09:08:13Z","products":[{"vendor":"iroadau","product":"fx2_firmware"}],"references":[{"url":"https://www.iroadau.com.au/downloads/","tags":["Product"]},{"url":"https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-7-bypass-of-device-pairingregistration-for-iroad-fx2","tags":["exploit","Third Party Advisory"]},{"url":"https://github.com/geo-chen/IROAD/blob/main/README.md#finding-12---cve-2025-30133-unprotected-url-shortcut","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30133"},{"url":"https://www.iroadau.com.au/downloads"},{"url":"https://github.com/advisories/GHSA-v9v8-8vjh-j435"}],"sources":{"cve":[{"id":"CVE-2025-30133","description":"An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the \"IROAD X View\" app for authentication, but its HTTP server lacks this restriction. Once connected to the dashcam's Wi-Fi network via the default password (\"qwertyuiop\"), an attacker can directly access the HTTP server at http://192.168.10.1 without undergoing the pairing process. Additionally, no alert is triggered on the device when an attacker connects, making this intrusion completely silent.","status":"published","published":"2025-07-28T00:00:00Z","modified":"2025-07-30T15:17:37.598Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:32:35.418416Z"}],"euvd":[{"id":"EUVD-2025-22908","description":"An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the \"IROAD X View\" app for authentication, but its HTTP server lacks this restriction. Once connected to the dashcam's Wi-Fi network via the default password (\"qwertyuiop\"), an attacker can directly access the HTTP server at http://192.168.10.1 without undergoing the pairing process. Additionally, no alert is triggered on the device when an attacker connects, making this intrusion completely silent.","status":"published","published":"2025-07-28T00:00:00Z","modified":"2025-07-30T15:17:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:02.888981Z"}],"ghsa":[{"id":"GHSA-v9v8-8vjh-j435","title":"An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can...","description":"An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the \"IROAD X View\" app for authentication, but its HTTP server lacks this restriction. Once connected to the dashcam's Wi-Fi network via the default password (\"qwertyuiop\"), an attacker can directly access the HTTP server at http://192.168.10.1 without undergoing the pairing process. Additionally, no alert is triggered on the device when an attacker connects, making this intrusion completely silent.","status":"published","published":"2025-07-28T15:31:40Z","modified":"2025-07-30T18:32:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:03:09.000825Z"}],"nvd":[{"id":"CVE-2025-30133","description":"An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the \"IROAD X View\" app for authentication, but its HTTP server lacks this restriction. Once connected to the dashcam's Wi-Fi network via the default password (\"qwertyuiop\"), an attacker can directly access the HTTP server at http://192.168.10.1 without undergoing the pairing process. Additionally, no alert is triggered on the device when an attacker connects, making this intrusion completely silent.","status":"published","published":"2025-07-28T14:15:26.83Z","modified":"2026-06-17T09:08:13.38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:11:21.132141Z"}]}}