CVE-2025-2350: IROAD Dash Cam FX2 upload_file unrestricted upload

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-16 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file /action/upload_file. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.

Affected products

IROAD Dash Cam FX2: through 2025-03-08

References

https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-10-unauthenticated-uploads
https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-11-unrestricted-webshell
https://vuldb.com/?ctiid.299816
https://vuldb.com/?id.299816

Get alerted when CVE-2025-2350 or the next vulnerability affects your stack