{"id":"CVE-2025-2344","state":"PUBLISHED","title":"IROAD Dash Cam X5/Dash Cam X6 API Endpoint missing authentication","description":"A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown functionality of the component API Endpoint. The manipulation leads to missing authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-03-16T18:00:07.198Z","updatedAt":"2025-03-17T14:17:13.638Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["IROAD Dash Cam X5","IROAD Dash Cam X6"],"affected":[{"vendor":"IROAD","product":"Dash Cam X5","versions":[{"version":"20250308","status":"affected"}],"modules":["API Endpoint"]},{"vendor":"IROAD","product":"Dash Cam X6","versions":[{"version":"20250308","status":"affected"}],"modules":["API Endpoint"]}],"references":["https://vuldb.com/?id.299810","https://vuldb.com/?ctiid.299810","https://vuldb.com/?submit.516882","https://github.com/geo-chen/IROAD#finding-4-remotely-dump-video-footage-and-live-video-stream"],"weaknesses":["CWE-306","CWE-287"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/2xxx/CVE-2025-2344.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-2344","state":"PUBLISHED","datePublished":"2025-03-16T18:00:07.198Z","dateUpdated":"2025-03-17T14:17:13.638Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-03-15T18:22:24.835Z"},"containers":{"cna":{"title":"IROAD Dash Cam X5/Dash Cam X6 API Endpoint missing authentication","descriptions":[{"lang":"en","value":"A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown functionality of the component API Endpoint. The manipulation leads to missing authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Eine kritische Schwachstelle wurde in IROAD Dash Cam X5 and Dash Cam X6 bis 20250308 entdeckt. Davon betroffen ist unbekannter Code der Komponente API Endpoint. Mittels dem Manipulieren mit unbekannten Daten kann eine missing authentication-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen."}],"affected":[{"vendor":"IROAD","product":"Dash Cam X5","versions":[{"version":"20250308","status":"affected"}],"modules":["API Endpoint"]},{"vendor":"IROAD","product":"Dash Cam X6","versions":[{"version":"20250308","status":"affected"}],"modules":["API Endpoint"]}],"references":[{"url":"https://vuldb.com/?id.299810","name":"VDB-299810 | IROAD Dash Cam X5/Dash Cam X6 API Endpoint missing authentication","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.299810","name":"VDB-299810 | CTI Indicators (IOB, IOC)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.516882","name":"Submit #516882 | IROAD Dashcam X series (X5, X6, etc) Missing Authentication","tags":["third-party-advisory"]},{"url":"https://github.com/geo-chen/IROAD#finding-4-remotely-dump-video-footage-and-live-video-stream","tags":["related"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","type":"CWE","lang":"en","description":"Missing Authentication"}]},{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"Improper Authentication"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-03-16T18:00:07.198Z"},"timeline":[{"time":"2025-03-15T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-03-15T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-03-15T19:27:53.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"geochen (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-17T14:17:05.273310Z","id":"CVE-2025-2344","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-17T14:17:13.638Z"}}]}}}