EUVD-2026-86465
GHSA-mrfq-pqvw-wjqq
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent WiFi vector (AV:A), no auth (PR:N); AC:H because the attacker must first attain an on-path/monitoring position to capture traffic; confidentiality-only (C:H, I:N, A:N).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device's WiFi network could obtain stored recordings, live video, location information, images, diagnostic logs, or other sensitive information exchanged between the device and its mobile application.
AnalysisAI
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video, GPS location, images and diagnostic logs to anyone who can observe the device's WiFi traffic, because the camera exchanges this data with its companion mobile app over unencrypted HTTP and RTSP rather than TLS or encrypted RTSP. The exposure is unauthenticated but adjacent-only (CVSS:4.0 AV:A/AC:L/PR:N, scored 7.1; independently assessed as CVSS:3.1 AV:A/AC:H with confidentiality-only impact), so it requires an attacker within wireless range of, or already joined to, the network the G980H uses to talk to its phone app. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to be able to intercept traffic on the dashcam's WiFi network - i.e., within wireless range and either joined to or monitoring the network the G980H uses to talk to its mobile app. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuine but bounded confidentiality issue in a niche consumer IoT product. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - the supplied advisory data contains no fixed firmware version and the CPE lists the G980H version as a wildcard, so check the CISA ICS advisory ICSA-26-267-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01) and the vendor page (https://www.botslab.com/pages/about-botslab) for later firmware before assuming one exists, and apply any vendor update if and when published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Botslab G980H dash cameras, isolate them on a dedicated VLAN with strong WPA2/WPA3 encryption and unique passwords, and disable any open or default access point configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the de
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a ca
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the sam
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial in
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network s
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range re
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is ter
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (t
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communic
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic lo
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today