CVE-2025-30135 Missing authorization in n/a
Attackers can access sensitive video recordings and live footage via HTTP and RTSP interfaces without authentication on IROAD Dashcam FX2 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30135?
CVE-2025-30135 is a critical missing authorization vulnerability in n/a, published on 25 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without Authentication can occur. It lacks authentication controls on its HTTP and RTSP interfaces, allowing attackers to retrieve sensitive files and video recordings. By connecting to http://192.168.10.1/mnt/extsd/event/, an attacker can download all stored video recordings in an unencrypted manner. Additionally, the RTSP stream on port 8554 is accessible without authentication, allowing an attacker to view live footage.
Weakness: CWE-306
Which versions are affected by CVE-2025-30135?
It affects 1 product.
Products include Iroadau Fx2 Firmware.
How do I fix CVE-2025-30135?
No fix has been published for CVE-2025-30135 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-30135 being exploited?
There is no known exploitation of CVE-2025-30135 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fhfq-8mf9-qxmx.