CyberSecBulletin

IROAD vulnerabilities

We track 5 vulnerabilities in IROAD products across 5 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 4, 2025.

5vulnerabilities
1critical
4high
0exploited
8.3average CVSS score

Latest IROAD vulnerabilities

  • 8.8 High severity

    Dashcam Q9: Uncontrolled Resource Consumption

    CVE-2025-7070IROAD

    A vulnerability has been found in IROAD Dashcam Q9 up to 20250624 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component MFA Pairing Request Handler. The manipulation leads to allocation of resources. The att

  • 7.8 High severity

    Dash Cam FX2: Unrestricted Upload of File with Dangerous Type

    CVE-2025-2350IROAD

    A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file /action/upload_file. The manipulation leads to unrestricted upload. Access to the local network is r

  • 7.8 High severity

    Dash Cam FX2: Use of Default Password

    CVE-2025-2347IROAD

    A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some unknown processing of the component Device Registration. The manipulation of the argument Password with the input qwertyuiop leads to use of d

  • 9.8 Critical severity

    Dash Cam X5: Incorrect Privilege Assignment

    CVE-2025-2345IROAD

    A vulnerability, which was classified as very critical, was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. This affects an unknown part. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The vendor wa

  • 7.5 High severity

    Dash Cam X5: Use of Hard-coded Password

    CVE-2025-2343IROAD

    A vulnerability classified as critical was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this vulnerability is an unknown functionality of the component Device Pairing. The manipulation leads to hard-coded credentials. Access to the lo