EUVD-2026-86456
GHSA-43w5-g724-88w6
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires physical access to removable storage (AV:P), no authentication once media is held (PR:N), and yields only credential/config disclosure (C:H, I:N, A:N).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the support process. These logs remain accessible on removable storage after the support operation has completed. An unauthenticated attacker with physical access to the storage media could retrieve the logs and obtain sensitive device information.
AnalysisAI
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic logs created during the vendor support process, and those logs persist on the removable storage media (microSD card) after the support session ends. An unauthenticated attacker who physically obtains the card can simply read the log files and recover the device's WiFi credentials and other configuration details; per the CVSS 4.0 vector AV:P/PR:N/UI:N this requires physical possession of the media, and there is no network-reachable path to the data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires physical possession of the dashcam's removable storage media AND that the diagnostic/support process was previously run, leaving log files containing WiFi credentials and device configuration on the card (CWE-532). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue despite the MEDIUM-band 5.1 CVSS 4.0 score, and the score itself is dominated by the physical attack vector (AV:P) rather than any remote reachability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the provided source data for CVE-2026-82716 - the CPE carries a wildcard version field and no advisory reference in the input points to a fixed firmware build - so consult CISA ICS advisory ICSA-26-267-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01, CSAF: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json) and the Botslab vendor page (https://www.botslab.com/pages/about-botslab) to confirm whether a patched firmware has since been released, and upgrade to that exact version if one exists. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the de
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a ca
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the sam
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial in
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network s
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range re
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is ter
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (t
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communic
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today