EUVD-2026-86464
GHSA-f3h4-c3cq-ch4g
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
UART access needs physical possession (AV:P) with no auth or interaction (PR:N/UI:N); hard-coded root yields full control, so C/I/A all High.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or has physical access to the device could recover the credential and use it to obtain root access through the UART interface.
AnalysisAI
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial interface to obtain full root access, because the password is embedded in the firmware and cannot be changed, rotated, or disabled by the user. Exploitation is physically gated: it requires hands-on access to the camera plus a serial connection, and per the assessed vector (CVSS:3.1 AV:P/AC:L/PR:N/UI:N, CVSS:4.0 base 7.0) there is no prior-privilege or user-interaction barrier once that physical connection is made, while remote or network exploitation is not possible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires physical access to the Botslab G980H dash camera and connection to its UART/serial interface, plus knowledge of the hard-coded root password (which cannot be changed by the user and is recoverable from the device firmware). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but physically-gated weakness, not a remotely-exploitable emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified in the available data, so remediation currently depends on compensating controls rather than a confirmed fixed firmware version; obtain the latest vendor guidance from the CISA ICS advisory ICSA-26-267-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01) and from Botslab (https://www.botslab.com/pages/about-botslab), and apply a vendor firmware update immediately if and when one is released. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Botslab G980H devices, document physical locations and custody chains, and restrict UART/serial access by locking or shielding debug ports and limiting hands-on access to trusted staff. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the de
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a ca
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the sam
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network s
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range re
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is ter
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (t
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communic
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic lo
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today