EUVD-2026-86412
GHSA-gf75-9hpg-2f97
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent access (AV:A) and no auth (PR:N), but reusing another client's live session identifier is a real precondition, so AC:H; privileged control yields full C:H/I:H/A:H.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession of a valid session identifier without adequately validating the requesting client's authenticated context. An unauthenticated attacker with adjacent network access could potentially use valid session state associated with another client to access privileged functionality.
AnalysisAI
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (the camera's Wi-Fi/link-local segment) reach privileged, session-gated commands by presenting a session identifier that belongs to a different, already-authenticated client, because the firmware never binds session state to the connection that created it (CWE-863). Successful abuse gives high impact to confidentiality, integrity and availability of the camera itself - full compromise of the device's privileged functionality - though exploitation is not opportunistic: an attacker must be within adjacent-network range and a legitimate client must already hold a live authenticated session whose identifier can be obtained or replayed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires adjacent network access (AV:A) to the Botslab G980H dash camera - the attacker must share the local/link-layer network the device uses (e.g., its Wi-Fi or companion-app connection), not remote internet access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 base score is 8.7 (High) with vector AV:A/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, indicating adjacent-network, unauthenticated access with full compromise of the affected system's confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed firmware version was identified at time of analysis; the ICS-CERT advisory ICSA-26-267-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01, CSAF: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json) is the tracking reference, and operators should monitor Botslab for a firmware update that binds each session identifier to its originating client connection and re-validates authorization on every privileged command. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Botslab G980H dash camera, record its firmware version, and disable Wi-Fi Direct/hotspot modes where possible or move the cameras onto a dedicated SSID/VLAN with no route to corporate, depot, or vehicle networks, using unique per-device WPA2/WPA3 credentials and the shortest session timeout the firmware supports. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the de
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a ca
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the sam
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial in
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network s
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range re
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is ter
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communic
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic lo
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today