EUVD-2026-86447
GHSA-2p59-278w-33v4
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent access with no auth (AV:A/PR:N); AC:H because success depends on a residual-session timing/state race; session takeover yields full C/I/A over device functions.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing client while previously established session state remains active until a separate expiration mechanism invalidates it. An unauthenticated attacker with adjacent network access could potentially take advantage of this residual authentication state to access functionality associated with another client's session.
AnalysisAI
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is terminated or displaced by a newly established connection, allowing an unauthenticated attacker with adjacent network access (same Wi-Fi/link-layer segment) to potentially reach functionality belonging to the displaced client's session (CWE-613). Exploitation is not internet-remote and is further gated by a race condition: the attacker must connect during the narrow window before the separate session-expiration mechanism invalidates the residual authenticated state, which is why an internal assessment scores the attack complexity as High (CVSS:3.1/AV:A/AC:H/PR:N/UI:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires adjacent network access (AV:A) to the same local/link-layer segment as the Botslab G980H dash camera - not remotely exploitable across the internet. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, base 8.7 HIGH) frames this as a high-impact, unauthenticated, adjacent-network flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed firmware version is identified in the available data; track CISA advisory ICSA-26-267-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01) and Botslab's product page (https://www.botslab.com/pages/about-botslab) and apply the vendor firmware update as soon as it is published, since the only durable fix is a firmware change that invalidates session state synchronously at connection teardown or displacement. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm the full inventory of Botslab G980H units and the firmware versions they run (the affected CPE is a wildcard covering all versions, so no unit can be assumed clean), and verify whether any vendor patch has been released since this assessment; also determine whether the cameras are reachable from general corporate or guest networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the de
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a ca
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the sam
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial in
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network s
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range re
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (t
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communic
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic lo
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today