CVE-2025-2350

Katalog CVE

CVSS 7.8 · High EPSS 0,26%

Kerentanan Improper Access Control pada iroadau fx2 firmware. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file /action/upload_file. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

16 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-10-unauthenticated-uploads advisory pihak ketiga
• https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-11-unrestricted-webshell advisory pihak ketiga
• https://vuldb.com/?id.299816 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.299816 permissions required · vdb entry