EUVD-2026-86451
GHSA-vf9h-pg8f-h64m
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent access (AV:A) and AC:H because the attacker must first capture a valid, transient authentication value before replaying; unauthenticated (PR:N), full session takeover gives C:H/I:H, no availability impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another client to establish an authenticated session and access privileged device functionality.
AnalysisAI
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a captured credential from a different client to obtain an authenticated session with privileged device functionality. The vulnerability affects all firmware revisions tracked under CPE cpe:2.3:a:botslab:g980h:*:*:*:*:*:*:*:* and is rated 8.6 under CVSS 4.0 (assessed 8.1 under CVSS 3.1 as AV:A/AC:H/PR:N/UI:N, with high confidentiality and integrity impact and no availability impact). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold adjacent network access (same local network / RF proximity as the Botslab G980H and its client, per AV:A) and to first CAPTURE a valid authentication value emitted by a legitimate client session - the flaw is that this value is reusable and not bound to the originating client or checked for freshness (CWE-294). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderate-to-high but not urgent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed firmware version is identified in the available advisory data; consult https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01 and Botslab (https://www.botslab.com/pages/about-botslab) for a firmware update and apply it as soon as one is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Botslab G980H dash cameras and ensure they are not connected to untrusted networks or public Wi-Fi; change default credentials to strong, unique values and disable remote access features if not essential. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the de
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the sam
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial in
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network s
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range re
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is ter
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (t
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communic
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic lo
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today