EUVD-2026-86460
GHSA-wm83-9wvp-2x5v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the network path requires MITM positioning on the firmware download to substitute a matching-integrity image; unauthenticated (PR:N) via that path; unsigned firmware flash yields full C/I/A compromise.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprotected connection and relies on an integrity value supplied with the firmware instead of a trusted cryptographic signature. A suitably positioned attacker who intercepts a firmware download, or an authenticated attacker who submits a crafted update, could install modified firmware and execute unauthorized code on the device.
AnalysisAI
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the device's firmware download or supply a crafted update package to install modified firmware and execute unauthorized code on the device. The update process fetches firmware over an unprotected connection and validates only an integrity value delivered alongside the payload rather than a trusted cryptographic signature, so anyone who controls the delivered bytes and recomputes that value defeats the check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the firmware update mechanism specifically: (1) the network path - the attacker must intercept the device's firmware download, which is transmitted over an unprotected (non-cryptographically-authenticated) connection, requiring MITM positioning between the camera and its update source; OR (2) the authenticated path - an attacker with valid update-submission access supplies a crafted update package. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority flaw for affected devices, though the intelligence signals are thin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the CISA ICS advisory ICSA-26-267-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01 and the Botslab site at https://www.botslab.com/pages/about-botslab should be monitored for a fixed firmware version and upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Botslab G980H dash cameras, record deployed firmware versions, and block or tightly restrict their outbound firmware-update traffic to approved destinations using network ACLs or a managed proxy; disable automatic firmware updates if the device supports it, and monitor for anomalous update downloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a ca
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the sam
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial in
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network s
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range re
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is ter
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (t
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communic
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic lo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today