Security Resilience

CVE-2025-30106

Exposed Creds

Exposed Creds
Published
18 March 2025
Modified
15 April 2026
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0028 19th percentile
Risk Priority 63 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-30106 is a high-severity Use of Hard-coded Password (CWE-259) vulnerability in Iroad Dashcam (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-30106 is a vulnerability in IROAD v9 dashcam devices stemming from hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. This issue, mapped to CWE-259 (Use of Hard-coded Password), enables unauthorized access to the device's Wi-Fi network. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

An attacker within Wi-Fi range of the affected device can exploit this vulnerability with low complexity and no required privileges or user interaction. By using the hardcoded credentials, the attacker gains network access, allowing them to perform packet sniffing and potentially capture sensitive traffic transmitted over the device's network.

References for this CVE include a GitHub repository at https://github.com/geo-chen/IROAD-V, which details the vulnerability, and a product page at https://iroad-dashcam.nl/iroad/iroad-x5/. No specific advisories or patches mentioning mitigations are provided in the available information.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

On IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. This allows an attacker within Wi-Fi range to connect to the device's network to perform sniffing.

CWE(s)
CWE-259

Related Threats

MITRE ATT&CK Enterprise Techniques

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1078.003 Local Accounts Stealth
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-8580Shared CWE-259
CVE-2025-61330Shared CWE-259
CVE-2024-7216Shared CWE-259
CVE-2026-22054Shared CWE-259
CVE-2026-65117Shared CWE-259
CVE-2025-70798Shared CWE-259
CVE-2024-2038Shared CWE-259
CVE-2026-71809Shared CWE-259
CVE-2025-25984Shared CWE-259
CVE-2025-27638Shared CWE-259

Affected Assets

Iroad Dashcam
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management partial match

Authenticator management requires secure distribution, rotation, and verification of credentials, directly stopping hard-coded passwords from being introduced or used.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly prohibit embedding credentials in source code or binaries.

References