How severe is CVE-2025-2350?

CVE-2025-2350 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2025-2350 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-2350?

CVE-2025-2350 affects Iroadau Fx2 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-2350?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-2350 have an EU (EUVD) identifier?

Yes. CVE-2025-2350 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-6639.

When was CVE-2025-2350 published?

CVE-2025-2350 was published on 2025-03-16 and last updated on 2026-06-17.

CVE-2025-2350

CVE-2025-2350 is a medium-severity vulnerability in Iroadau Fx2 Firmware with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-434.

Key facts

Severity: Medium (CVSS 3.x base score 6.3)
CVSS v2: 5.8
CVSS v4: 5.3
EPSS exploit prediction: 0% (14th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-6639
Weakness: CWE-434
Affected product: Iroadau Fx2 Firmware
Published: 2025-03-16
Last modified: 2026-06-17

Description

A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file /action/upload_file. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.

Frequently asked questions

What is CVE-2025-2350?: A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file /action/upload_file. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.
How severe is CVE-2025-2350?: CVE-2025-2350 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2025-2350 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-2350?: CVE-2025-2350 affects Iroadau Fx2 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-2350?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-2350 have an EU (EUVD) identifier?: Yes. CVE-2025-2350 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-6639.
When was CVE-2025-2350 published?: CVE-2025-2350 was published on 2025-03-16 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:iroadau:fx2_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Iroadau Fx2 Firmware

CVE-2025-30133 — Critical (CVSS 9.8): An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires…
CVE-2025-30131 — Critical (CVSS 9.8): An issue was discovered on IROAD Dashcam FX2 devices. An unauthenticated file upload endpoint can be leveraged to…
CVE-2025-30135 — Critical (CVSS 9.4): An issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without Authentication can…
CVE-2025-2347 — Medium (CVSS 6.3): A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some…
CVE-2025-2348 — Medium (CVSS 4.3): A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been classified as problematic. Affected is an…
CVE-2025-2349 — Low (CVSS 3.1): A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been declared as problematic. Affected by this…

All CVEs affecting Iroadau Fx2 Firmware →

Other CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities

CVE-2026-48283 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type…
CVE-2026-48276 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type…
CVE-2026-57700 — Critical (CVSS 10.0): Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This…
CVE-2025-69129 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7…
CVE-2026-40772 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.
CVE-2026-40412 — Critical (CVSS 10.0): Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code…

Browse all CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities →