CVE-2025-30123

CRITICAL

ROADCAM X3 - Use of Hard-coded Credentials in Mobile App APK

Title source: llm
STIX 2.1

Description

An issue was discovered on ROADCAM X3 devices. The mobile app APK (Viidure) contains hardcoded FTP credentials for the FTPX user account, enabling attackers to gain unauthorized access and extract sensitive recorded footage from the device.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0039
EPSS Percentile 30.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-798
Status published
Published Mar 18, 2025
Tracked Since Feb 18, 2026