Dashcam Android Application
Monthly
Unauthenticated extraction of permanent, plaintext cloud storage credentials from the Viidure Android dashcam companion application (CVE-2026-96587) gives any party who obtains the publicly distributed APK full read, write, and delete access to backend object storage holding operational files such as firmware and application binaries. Because the credentials are hardcoded in the shipped artifact and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation requires only network reachability to the storage endpoint plus routine decompilation of the app package - no victim interaction, authentication, or non-default configuration is needed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiter is the niche install base of this consumer dashcam app rather than any technical barrier; the independent assessment nevertheless flags this as a genuine high-priority finding because the exposure is architectural (server-side credential revocation is the only real containment) and write/delete scope against firmware could enable tampering with the update channel if the recovered keys retain that privilege.
Unrestricted public read access to the Viidure dashcam platform's central cloud storage bucket exposes sensitive user records, live dashcam footage, application packages, and firmware files to anyone on the internet. Because CPE data ties the affected asset to the Viidure Dashcam Android application and the bucket is the shared storage backend for the whole platform, the exposure is platform-wide rather than isolated to a single customer or object. The issue is remotely reachable by unauthenticated attackers (CVSS 4.0 vector AV:N/PR:N/UI:N) with high confidentiality impact only (VC:H, VI:N, VA:N) and a CVSS score of 8.7; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although accessing the data requires nothing more than an unauthenticated request to the bucket. Our independent assessment agrees this is a genuine, high-real-risk data exposure rather than an inflated CVSS score.
Unauthenticated extraction of permanent, plaintext cloud storage credentials from the Viidure Android dashcam companion application (CVE-2026-96587) gives any party who obtains the publicly distributed APK full read, write, and delete access to backend object storage holding operational files such as firmware and application binaries. Because the credentials are hardcoded in the shipped artifact and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation requires only network reachability to the storage endpoint plus routine decompilation of the app package - no victim interaction, authentication, or non-default configuration is needed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiter is the niche install base of this consumer dashcam app rather than any technical barrier; the independent assessment nevertheless flags this as a genuine high-priority finding because the exposure is architectural (server-side credential revocation is the only real containment) and write/delete scope against firmware could enable tampering with the update channel if the recovered keys retain that privilege.
Unrestricted public read access to the Viidure dashcam platform's central cloud storage bucket exposes sensitive user records, live dashcam footage, application packages, and firmware files to anyone on the internet. Because CPE data ties the affected asset to the Viidure Dashcam Android application and the bucket is the shared storage backend for the whole platform, the exposure is platform-wide rather than isolated to a single customer or object. The issue is remotely reachable by unauthenticated attackers (CVSS 4.0 vector AV:N/PR:N/UI:N) with high confidentiality impact only (VC:H, VI:N, VA:N) and a CVSS score of 8.7; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although accessing the data requires nothing more than an unauthenticated request to the bucket. Our independent assessment agrees this is a genuine, high-real-risk data exposure rather than an inflated CVSS score.