EUVD-2026-89457
GHSA-947q-qf7p-x7c7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Impact | This is a genuine, high-real-risk data exposure rather than an inflated CVSS score. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H) is internally consistent with the description: a cloud storage bucket set to public-read is reachable by anyone on the internet with no authentication, no user interaction, and trivial complexity - the classic profile of a discoverable, scriptable exposure. The 8.7 score is driven entirely by confidentiality (VC:H) with VI:N/VA:N, which correctly reflects a read-only disclosure with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis' - but note that for misconfigured public buckets, 'exploitation' requires only knowing/guessing the bucket URL, so the absence of a formal PoC understates practical accessibility. Conflicting/soft signals to verify: this is reported as an ICS advisory (icscert, ICSA-26-272-07) for a consumer dashcam Android app, and the flaw is a server-side/cloud misconfiguration, not a defect in the shipped Android binary named by the CPE - remediation is a vendor-side ACL change, so there may be no downloadable patch. Overall: real priority for affected users' privacy despite lacking KEV/EPSS/PoC signals. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Unrestricted public read access to the Viidure dashcam platform's central cloud storage bucket exposes sensitive user records, live dashcam footage, application packages, and firmware files to anyone on the internet. Because CPE data ties the affected asset to the Viidure Dashcam Android application and the bucket is the shared storage backend for the whole platform, the exposure is platform-wide rather than isolated to a single customer or object. The issue is remotely reachable by unauthenticated attackers (CVSS 4.0 vector AV:N/PR:N/UI:N) with high confidentiality impact only (VC:H, VI:N, VA:N) and a CVSS score of 8.7; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although accessing the data requires nothing more than an unauthenticated request to the bucket. Our independent assessment agrees this is a genuine, high-real-risk data exposure rather than an inflated CVSS score.
RemediationAI
No vendor-released patch was identified at time of analysis, and for a CWE-732 public-read bucket misconfiguration the fix is configuration-side rather than a code update. Immediately set the bucket to private, remove any public-read ACL or bucket policy granting the anonymous or AllUsers principal GetObject/ListBucket, and enable account- or organization-level Block Public Access so the setting cannot be silently reverted; verify with an unauthenticated request from outside the tenancy. Review object access logs (e.g., S3 server access logs or CloudTrail data events) for prior enumeration and bulk downloads, and treat everything in the bucket as compromised: rotate any credentials, API keys, or signing material shipped inside exposed application packages or firmware, invalidate previously public object URLs, and notify affected users whose records or footage were exposed. If application or firmware delivery depends on public object URLs, migrate to signed, short-lived URLs or a CDN with an origin access identity - the trade-off is added signing infrastructure and possible breakage of cached or hard-coded links in already-deployed clients, which must be updated or redirected. Confirm current guidance against the ICS CERT advisory ICSA-26-272-07 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07), the CSAF JSON (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-07.json), and the vendor site https://viidure.app/ for any published fix, remediation timeline, or vendor statement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource): the object storage bucket backing the dashcam platform is configured with public-read permissions, either through a legacy ACL or a bucket policy that grants the anonymous principal object read (and likely list) operations. This is a cloud object-storage access-control failure rather than a memory-safety or injection flaw - there is no exploit primitive to build, only an over-permissive policy that any internet host can exercise over HTTPS. The CPE cpe:2.3:a:viidure:dashcam_android_application:*:*:*:*:*:*:*:* indicates the Viidure Dashcam Android application is the affected product, with the wildcard version confirming no fixed release is identified; the bucket functions as shared infrastructure for the mobile app, storing user records, live footage, installable app packages, and device firmware. The CVSS 4.0 profile is consistent with a read-only misconfiguration: network-vectored, no privileges or user interaction required, high confidentiality loss, but no integrity (VI:N) and no availability (VA:N) impact, which maps cleanly to anonymous read access without write or delete capability. Reported by ICS CERT under advisory ICSA-26-272-07, which places this in the ICS/mobile-product advisory stream and signals that the vendor's platform, not just a single deployment, is in scope.
Know when Dashcam Android Application gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (icscert) · only source for this CVE.
CVSS VectorVendor: icscert
DescriptionCVE.org
The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.
Executive ViewAI
The Viidure dashcam platform's central cloud storage bucket is publicly accessible, exposing sensitive user records, live dashcam footage, and firmware to unauthenticated attackers. This platform-wide exposure affects all customers and could result in privacy violations, regulatory penalties, and reputational harm. Leadership should prioritize immediate mitigation; no vendor-released patch identified at time of analysis.
Immediately set the storage bucket to private, enforce authentication for all access, enable access logging and monitoring, and rotate any exposed credentials or tokens. Additionally, implement network-level restrictions and encrypt data at rest with keys not publicly accessible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB