CVE-2025-2349

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2349
A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /etc/passwd of the component Password Hash Handler. The manipulation leads to password hash with insufficient computational effort. Access to the local network is required for this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.8 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:A/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 3.2 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-9-exposed-root-password Third Party Advisory
https://vuldb.com/?ctiid.299815 Permissions Required VDB Entry
https://vuldb.com/?id.299815 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:iroadau:fx2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:iroadau:fx2:-:*:*:*:*:*:*:*
History

06 Nov 2025, 20:38

Type Values Removed Values Added
CPE cpe:2.3:o:iroadau:fx2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:iroadau:fx2:-:*:*:*:*:*:*:*
Summary
  • (es) Se encontró una vulnerabilidad en IROAD Dash Cam FX2 hasta la versión 20250308. Se ha declarado problemática. Esta vulnerabilidad afecta a una funcionalidad desconocida del archivo /etc/passwd del componente Password Hash Handler. La manipulación genera un hash de contraseña con un esfuerzo computacional insuficiente. Este ataque requiere acceso a la red local. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado.
First Time Iroadau fx2
Iroadau fx2 Firmware
Iroadau
References () https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-9-exposed-root-password - () https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-9-exposed-root-password - Third Party Advisory
References () https://vuldb.com/?ctiid.299815 - () https://vuldb.com/?ctiid.299815 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.299815 - () https://vuldb.com/?id.299815 - Third Party Advisory, VDB Entry

16 Mar 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-16 22:15

Updated : 2025-11-06 20:38

NVD link : CVE-2025-2349

Mitre link : CVE-2025-2349

CVE.ORG link : CVE-2025-2349

JSON object : View

Products Affected

iroadau

  • fx2_firmware
  • fx2
CWE
CWE-326

Inadequate Encryption Strength

CWE-916

Use of Password Hash With Insufficient Computational Effort