Botslab G980H CVE-2026-88761

Requires the attacker to be within physical WiFi range of a Botslab G980H dash camera operating with its DEFAULT WiFi password unchanged. The camera advertises portions of the device information used to derive that password, leaving only a limited remaining keyspace to guess. Limiting factors: adjacent-network access only (no remote/internet exploitation), the AT:P attack requirement (some guessing effort against the residual characters), and mitigation is trivial where the operator has changed the default WiFi password. Impact is confined to gaining access to the device's own WiFi network.

Moderate, geographically-constrained risk. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N, base 6.0) is internally consistent with the description: exploitation requires WiFi-adjacent physical proximity (AV:A), no privileges or user interaction, and carries an AT:P attack-requirement reflecting the limited guessing needed to recover the unadvertised password characters. Impact is confidentiality-only (VC:H) - gaining network access - with no integrity or availability impact scored. No EPSS score, no CISA KEV entry, and no public POC are present in the input, so there is no evidence of active or automated exploitation; the AT:P requirement plus WiFi-range proximity makes mass/remote exploitation infeasible, so this is a targeted opportunistic issue rather than a scalable one. This is a real weakness (CWE-1391, predictable credentials) but a low-priority one relative to network-remotely-exploitable flaws: the AV:A adjacency and the physical-proximity constraint are the dominant risk limiters. Note the tag 'Authentication Bypass' loosely characterizes a predictable-credential weakness; it does not indicate a true auth-logic bypass.

An attacker parked within WiFi range of a vehicle observes the portions of the dash camera's device information that the product advertises (e.g., over its beacon/SSID), reconstructs most of the default WiFi password, and brute-forces the small remaining keyspace to join the camera's network. Once associated, the attacker has unauthorized access to the device network and its exposed services. No public exploit code is identified at time of analysis, and exploitation requires physical WiFi proximity.