Botslab G980H CVE-2026-88956

Requires local physical access to the device's UART (serial debug) interface - the attacker must open or reach the hardware and connect to the UART pins. Once connected, the root account grants a privileged system shell WITHOUT any password (CWE-306), and the same interface prints the device's WiFi password during startup. Limiting factors: exploitation is impossible remotely or over the network (AV:P), requires hands-on hardware access and a UART adapter, and is inherently one-device-at-a-time; no user interaction or prior authentication is otherwise needed once physical access is obtained.

This is a genuine but access-gated flaw whose real-world risk is bounded by its physical attack vector. The vendor/NVD CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 7.0) accurately captures that an attacker who is physically at the device gains full compromise - root via a passwordless UART console plus recovery of the WiFi password - but the AV:P (Physical) metric is the dominant risk-limiting signal: exploitation requires opening/accessing the dash camera and wiring to its UART pins, which precludes remote or scalable attacks. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so this is 'no public exploit identified at time of analysis' rather than an actively exploited threat. SSVC-style reasoning: exploitation=none observed, automatable=no (physical, per-device), technical impact=total (root) - netting a low-to-moderate patch priority for most fleets. The high impact metrics (VC/VI/VA:H) reflect complete device takeover once physical access is achieved, but the physical prerequisite means this is a targeted/opportunistic-theft or supply-chain/rental scenario, not a mass-exploitation issue. No conflicting signals: the CVSS vector, CWE-306, and the description all consistently describe a passwordless privileged local console.

An attacker with temporary physical possession of the Botslab G980H dash camera (e.g., a rental/shared vehicle, resale, or a serviced/stolen unit) opens the housing, connects a USB-to-UART adapter to the debug pins, and boots the device. The passwordless root account drops them straight into a privileged shell, and the startup output prints the device's WiFi password, giving full device control and the network credential. No public exploit code is required - the access is inherent to the exposed interface.