VulnerabilityDeferred

CVE-2025-30123

The mobile app APK (Viidure) contains hardcoded FTP credentials for the FTPX user account, enabling attackers to gain unauthorized access and extract sensitive recorded footage from the device.

CRITICAL 9.8EPSS 0.43%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An issue was discovered on ROADCAM X3 devices. The mobile app APK (Viidure) contains hardcoded FTP credentials for the FTPX user account, enabling attackers to gain unauthorized access and extract sensitive recorded footage from the device.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.43% probability · 36th percentile
CISA KEV: Not listed
Weakness: CWE-798
Source: cve@mitre.org

References

https://github.com/geo-chen/RoadCam
https://roadcam.my/pages/install-x3

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.