EUVD-2026-86459
GHSA-26fw-w27q-phjj
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent range plus dual requirement of intercepting the credential and extracting firmware crypto gives AV:A/AC:H; unauthenticated (PR:N); confidentiality-only impact (WiFi password recovery), so I:N/A:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password and gain unauthorized access to the device network.
AnalysisAI
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communicates using a hard-coded cryptographic key and initialization vector (CWE-321). An attacker who is within adjacent wireless range of the camera, captures the protected credential, and then extracts the key and IV from a firmware image can recover the WiFi password and join the camera's network; no authentication or user interaction is required, though the combination of credential interception and firmware reverse-engineering makes practical exploitation difficult (CVSS 4.0 base 6.0; assessed as AV:A/AC:H/PR:N/UI:N with high confidentiality impact only). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to be in adjacent wireless range of a Botslab G980H dash camera AND to obtain the device-communicated encrypted WiFi credential AND to extract the hard-coded cryptographic key and IV from the firmware image - reflected in AV:A and AC:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is LOW-to-MODERATE and localized. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so the primary action is to monitor CISA advisory ICSA-26-267-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01) and Botslab's support/download pages (https://www.botslab.com/pages/about-botslab) for a firmware update that replaces the hard-coded key/IV with per-device derived material, and to apply it as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the de
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a ca
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the sam
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial in
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network s
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range re
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is ter
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (t
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic lo
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today