CVE-2025-2347: Iroadau Fx2 Firmware Auth Bypass Flaw

CVE-2025-2347 Overview

CVE-2025-2347 affects IROAD Dash Cam FX2 firmware up to version 20250308. The vulnerability resides in the Device Registration component, which accepts a hardcoded default password (qwertyuiop) to complete device pairing. An attacker on the same local network can register with the dash cam without possessing valid credentials. The weakness is classified as [CWE-1393] Use of Default Password. Public exploitation details have been disclosed through a GitHub proof-of-concept repository and VulDB entry 299813.

Critical Impact
Attackers within the local network can bypass device pairing and register unauthorized clients with the dash cam by supplying the default password, exposing recorded footage and device controls.

Affected Products

IROAD Dash Cam FX2 (hardware)
IROAD FX2 firmware versions up to 20250308
Deployments using default factory pairing credentials

Discovery Timeline

2025-03-16 - CVE-2025-2347 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2347

Vulnerability Analysis

The IROAD FX2 dash cam ships with a hardcoded pairing password of qwertyuiop. The Device Registration component accepts this static credential to authorize new clients that request to pair with the camera. Because the password is not user-configurable during initial provisioning and is identical across shipped units, any actor on the adjacent network can reproduce the pairing handshake.

The weakness maps to [CWE-1393] Use of Default Password. Successful pairing grants an attacker the same client-level interaction as a legitimate owner, including access to Wi-Fi-exposed device APIs, recorded video, and configuration endpoints. The attack does not require user interaction on the victim device.

Root Cause

The root cause is the presence of a static, publicly known default password embedded in the firmware pairing flow. The device does not enforce credential rotation, does not require the owner to set a unique password before enabling pairing, and does not throttle or lock out repeated pairing attempts. This design pattern is common in consumer IoT firmware and represents a broken authentication baseline.

Attack Vector

The attack vector is Adjacent Network. An attacker must be associated with the same Wi-Fi network or hotspot exposed by the dash cam. Once connected, the attacker submits the default password qwertyuiop to the pairing endpoint documented in the public proof-of-concept. Because the FX2 typically operates as an access point during setup, an attacker within radio range of a device in pairing mode can complete registration without user interaction. Technical details are documented in the GitHub PoC repository and VulDB entry 299813.

Detection Methods for CVE-2025-2347

Indicators of Compromise

Unexpected paired clients or MAC addresses listed in the FX2 companion application
Pairing or registration requests from adjacent wireless clients that were not initiated by the owner
Wi-Fi association logs showing unknown devices connecting to the dash cam SSID

Detection Strategies

Monitor wireless traffic near vehicles for unauthorized association attempts to IROAD FX2 access points
Inspect the dash cam pairing endpoint for authentication attempts using the string qwertyuiop
Compare the list of registered clients against the owner's known devices on a recurring basis

Monitoring Recommendations

Enable and review Wi-Fi client logs on the FX2 where the firmware supports it
Alert on new device pairings occurring outside of expected provisioning windows
Track firmware version reporting from fleet-managed dash cams to identify units still running versions at or below 20250308

How to Mitigate CVE-2025-2347

Immediate Actions Required

Change the default pairing password from qwertyuiop to a strong, unique value on every FX2 unit if the interface permits
Disable the dash cam Wi-Fi or pairing mode when not actively provisioning a client device
Inventory all IROAD FX2 dash cams and confirm firmware version, isolating units at or below 20250308

Patch Information

No vendor advisory or fixed firmware version has been published in the referenced sources as of the last NVD update on 2026-06-17. Monitor IROAD channels for a firmware release addressing the Device Registration component and apply it as soon as it becomes available.

Workarounds

Keep the FX2 access point disabled except during brief, supervised pairing sessions
Physically restrict access to the vehicle to reduce opportunities for adjacent-network attacks
Remove unrecognized paired clients through the companion application and re-pair only trusted devices

bash

# Configuration example
# No vendor-supplied configuration hardening is documented.
# Operational workaround: only enable pairing mode when provisioning a new client.