CVE-2025-30133

An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the "IROAD X View" app for authentication, but its HTTP server lacks this restriction. Once connected to the dashcam's Wi-Fi network via the default password ("qwertyuiop"), an attacker can directly access the HTTP server at http://192.168.10.1 without undergoing the pairing process. Additionally, no alert is triggered on the device when an attacker connects, making this intrusion completely silent.

• CWE-284

• https://github.com/geo-chen/IROAD/blob/main/README.md#finding-12---cve-2025-30133-unprotected-url-shortcutThird Party Advisory
• https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-7-bypass-of-device-pairingregistration-for-iroad-fx2Third Party Advisory
• https://www.iroadau.com.au/downloads/Product
• https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-7-bypass-of-device-pairingregistration-for-iroad-fx2Third Party Advisory

Published

Jul 28, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30125An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 de…9.8
• CVE-2025-30126An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 de…5.3
• CVE-2025-30127An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 de…9.8
• CVE-2025-3013Insecure Direct Object References (IDOR) in access control i…8.3
• CVE-2025-30131An issue was discovered on IROAD Dashcam FX2 devices. An una…9.8
• CVE-2025-30132An issue was discovered on IROAD Dashcam V devices. It uses …9.1
• CVE-2025-30135An issue was discovered on IROAD Dashcam FX2 devices. Dumpin…9.4
• CVE-2025-30137An issue was discovered in the G-Net GNET APK 2.6.2. Hardcod…9.8
• CVE-2025-30138An issue was discovered on G-Net Dashcam BB GONX devices. Ma…4.6
• CVE-2025-30139An issue was discovered on G-Net Dashcam BB GONX devices. De…9.8
• CVE-2025-3014Insecure Direct Object References (IDOR) in access control i…8.3
• CVE-2025-30140An issue was discovered on G-Net Dashcam BB GONX devices. A …7.5