SecuriTricks - CVE-2025-2349

Description

A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /etc/passwd of the component Password Hash Handler. The manipulation leads to password hash with insufficient computational effort. Access to the local network is required for this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Product(s) Impacted

Vendor	Product	Versions
Iroad	Dash Cam Fx2	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	iroad	dash_cam_fx2	/	/	/	/	/	/	/	/

References

https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-9-exposed-root-password

https://vuldb.com/?ctiid.299815

https://vuldb.com/?id.299815

CVSS Score

3.1 / 10

CVSS Data - 3.1

Attack Vector: ADJACENT_NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

View Vector String

Timeline

Published: March 16, 2025, 10:15 p.m.
Last Modified: March 16, 2025, 10:15 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cna@vuldb.com

CVE-2025-2349