CVE-2025-2348: IROAD Dash Cam FX2 HTTP/RTSP event information disclosure

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-16 · updated 2026-06-17
Weakness: CWE-200

Description

A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been classified as problematic. Affected is an unknown function of the file /mnt/extsd/event/ of the component HTTP/RTSP. The manipulation leads to information disclosure. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.

Affected products

IROAD Dash Cam FX2: through 2025-03-08

References

https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-8-dumping-files-over-http-and-rtsp-without-authentication
https://vuldb.com/?ctiid.299814
https://vuldb.com/?id.299814

Get alerted when CVE-2025-2348 or the next vulnerability affects your stack