EUVD-2026-86458
GHSA-3h8g-whmq-fxr3
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
BLE range makes this Adjacent not Local; no pairing means PR:N/UI:N; impact is confidentiality-only (device data plus WiFi credentials), so C:H, I:N, A:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device information, including device identifiers, firmware information, and protected WiFi credentials.
AnalysisAI
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range read sensitive on-device data - device identifiers, firmware details, and protected WiFi credentials - because the firmware exposes GATT characteristics without requiring authenticated pairing or client binding. The flaw is a missing-authentication condition (CWE-306) that exists in the default device state, so no credentials, user interaction, or special tooling are required; the practical constraint is physical proximity, as there is no internet-reachable attack path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be within Bluetooth Low Energy radio range of a powered-on Botslab G980H dash camera, because the firmware permits BLE/GATT characteristic access without authenticated pairing or client binding (CWE-306). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but geographically/physically constrained information-disclosure issue rather than a mass-exploitable network flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so remediation must currently rely on compensating controls; operators should track CISA advisory ICSA-26-267-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01) and the vendor page (https://www.botslab.com/pages/about-botslab) for a firmware fix, and apply it when published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the de
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a ca
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the sam
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial in
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network s
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is ter
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (t
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communic
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic lo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today