critical9.8
CVE-2025-30131
An issue was discovered on IROAD Dashcam FX2 devices.
Impact
An issue was discovered on IROAD Dashcam FX2 devices. An unauthenticated file upload endpoint can be leveraged to execute arbitrary commands by uploading a CGI-based webshell. Once a file is uploaded, the attacker can execute commands with root privileges, gaining full control over the dashcam. Additionally, by uploading a netcat (nc) binary, the attacker can establish a reverse shell, maintaining persistent remote and privileged access to the device. This allows complete device takeover.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Iroadau | Fx2 Firmware | All versions |