CVE-2025-2350: Iroadau Fx2 Firmware Auth Bypass Flaw

CVE-2025-2350 Overview

CVE-2025-2350 is an unrestricted file upload vulnerability affecting the IROAD Dash Cam FX2 firmware through version 20250308. The flaw resides in the /action/upload_file endpoint, which fails to validate uploaded file content or type. An attacker on the adjacent network can upload arbitrary files, including webshells, without authentication. Public proof-of-concept code demonstrating both unauthenticated uploads and webshell deployment has been disclosed on GitHub. The vulnerability is tracked under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and [CWE-284] (Improper Access Control).

Critical Impact
An unauthenticated attacker with adjacent network access can upload arbitrary files to the dash cam, enabling webshell deployment and full device compromise.

Affected Products

IROAD Dash Cam FX2 (hardware)
IROAD FX2 firmware versions up to and including 20250308
Deployments exposing the FX2 Wi-Fi or local web interface

Discovery Timeline

2025-03-16 - CVE-2025-2350 published to NVD
2025-11-06 - Last updated in NVD database

Technical Details for CVE-2025-2350

Vulnerability Analysis

The IROAD FX2 dash cam exposes an HTTP endpoint at /action/upload_file that accepts file uploads from any client on the local network. The endpoint does not enforce authentication and does not restrict the type, extension, or content of uploaded files. As a result, an attacker can write arbitrary files into the device's web-accessible directory.

Because the device serves uploaded content through its embedded web server, attackers can upload server-side scripts and request them to achieve code execution on the device. Public proof-of-concept material demonstrates both raw unauthenticated file upload and full webshell delivery against the FX2.

The vulnerability requires access to the adjacent network, typically the Wi-Fi network broadcast or joined by the dash cam. Many IROAD devices operate as Wi-Fi access points using default or weak credentials, expanding the realistic attack surface.

Root Cause

The root cause is two-fold. First, the /action/upload_file handler lacks authentication checks, violating [CWE-284]. Second, the handler does not validate file extensions, MIME types, or content signatures before writing to disk, violating [CWE-434]. The combination allows direct delivery of executable webshells to the device.

Attack Vector

An attacker joins the same network as the dash cam, then issues an HTTP POST request to /action/upload_file containing a malicious payload such as a CGI or shell script. The device stores the file in a directory served by its web server. The attacker then requests the uploaded file to trigger execution and obtain a webshell on the device.

Technical details and reproduction steps are documented in the public research at geo-chen/IROAD - Unauthenticated Uploads and geo-chen/IROAD - Unrestricted Webshell.

Detection Methods for CVE-2025-2350

Indicators of Compromise

HTTP POST requests to /action/upload_file on FX2 devices from unexpected clients on the local or Wi-Fi network
New or unexpected files with executable extensions (.sh, .cgi, .php, .py) in the device's web root
Outbound connections from the dash cam to unfamiliar external hosts, suggesting webshell-driven command-and-control
Web access logs showing GET requests to recently uploaded files immediately following upload activity

Detection Strategies

Monitor wireless and LAN traffic for HTTP POST requests targeting the /action/upload_file URI on IROAD FX2 IP addresses
Inspect HTTP request bodies for multipart uploads containing script or shell payloads destined for embedded devices
Baseline normal management traffic to the dash cam and alert on deviations such as uploads from non-admin endpoints
Correlate upload events with subsequent GET requests to the same filename, a strong webshell-installation signal

Monitoring Recommendations

Enable network flow logging on the segment hosting IoT and vehicle telematics devices, then forward logs to a centralized analytics platform
Treat the dash cam network segment as untrusted and monitor for any device-initiated outbound traffic beyond expected cloud endpoints
Periodically scan the local network for the FX2 web interface and validate firmware version against the vendor's latest release

How to Mitigate CVE-2025-2350

Immediate Actions Required

Isolate IROAD FX2 dash cams on a dedicated VLAN or Wi-Fi SSID with no route to corporate or sensitive networks
Disable the device's Wi-Fi access point feature when not actively pairing a phone or management client
Change any default Wi-Fi and administrative credentials on the dash cam to strong, unique values
Restrict physical and wireless access to vehicles containing the affected device

Patch Information

No vendor advisory or patched firmware release is referenced in the available CVE data. Operators should monitor the IROAD product channels for an updated firmware build that addresses the /action/upload_file endpoint and apply it as soon as available.

Workarounds

Block inbound HTTP requests to /action/upload_file at any intermediate gateway or firewall that sits between clients and the dash cam
Power down or disconnect the dash cam from networks when not in active use, particularly in shared parking or fleet environments
Avoid pairing the device with untrusted Wi-Fi networks and disable automatic reconnection to open SSIDs

bash

# Example: drop traffic to the vulnerable endpoint at an upstream Linux gateway
iptables -A FORWARD -p tcp -d <FX2_IP> --dport 80 \
  -m string --string "/action/upload_file" --algo bm \
  -j DROP