G980H
Monthly
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video, GPS location, images and diagnostic logs to anyone who can observe the device's WiFi traffic, because the camera exchanges this data with its companion mobile app over unencrypted HTTP and RTSP rather than TLS or encrypted RTSP. The exposure is unauthenticated but adjacent-only (CVSS:4.0 AV:A/AC:L/PR:N, scored 7.1; independently assessed as CVSS:3.1 AV:A/AC:H with confidentiality-only impact), so it requires an attacker within wireless range of, or already joined to, the network the G980H uses to talk to its phone app. No public exploit code has been identified at time of analysis and the issue has not been confirmed as actively exploited (not in CISA KEV); practical risk hinges on how easily the WiFi segment can be reached, which is worse if the camera's access point uses a predictable or default password.
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial interface to obtain full root access, because the password is embedded in the firmware and cannot be changed, rotated, or disabled by the user. Exploitation is physically gated: it requires hands-on access to the camera plus a serial connection, and per the assessed vector (CVSS:3.1 AV:P/AC:L/PR:N/UI:N, CVSS:4.0 base 7.0) there is no prior-privilege or user-interaction barrier once that physical connection is made, while remote or network exploitation is not possible. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is limited to attackers with device custody or those who obtain a firmware image, in which case the exposed credential grants complete control of the device (C:H/I:H/A:H).
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's own WiFi network retrieve files from its removable storage without authentication or user interaction. Readable content includes recordings, images, diagnostic logs and firmware files, which are exactly the artifacts a web server should never expose. CISA's ICS advisory ICSA-26-267-01 tracks the issue as CWE-22 and scores it 7.1 (High), driven entirely by confidentiality impact; proximity is the limiting factor, since the flaw is reachable only from the adjacent network and cannot be triggered from the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the device's firmware download or supply a crafted update package to install modified firmware and execute unauthorized code on the device. The update process fetches firmware over an unprotected connection and validates only an integrity value delivered alongside the payload rather than a trusted cryptographic signature, so anyone who controls the delivered bytes and recomputes that value defeats the check. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as high severity but with a harder attack path than the vendor-published CVSS 4.0 score of 9.2 suggests, since the attacker needs either an on-path network position between camera and update source or authenticated update-submission access; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the intelligence signals around this advisory remain thin.
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a captured credential from a different client to obtain an authenticated session with privileged device functionality. The vulnerability affects all firmware revisions tracked under CPE cpe:2.3:a:botslab:g980h:*:*:*:*:*:*:*:* and is rated 8.6 under CVSS 4.0 (assessed 8.1 under CVSS 3.1 as AV:A/AC:H/PR:N/UI:N, with high confidentiality and integrity impact and no availability impact). Exploitation is unauthenticated per the vector (PR:N/UI:N) but requires the attacker to already be positioned on the same local network or RF proximity as the camera and its legitimate client, and to capture a valid authentication value before or while it is still usable; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so risk signals are moderate-to-high rather than urgent.
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the same adjacent network to enumerate or guess a valid session ID and use it to bypass the device's authorization controls, gaining high-impact read/write access to camera functionality. Exploitation is constrained rather than trivial: the attacker must already be on the same local/link-layer network as the camera and must time the attempt to coincide with a legitimate active session, and the supplied CVSS 4.0 vector reflects that prerequisite via AT:P alongside AV:A, PR:N and UI:N. There is no remote-internet attack path, so this is best characterized as a genuine but not high-priority weakness; no public exploit code has been identified at time of analysis and no CISA KEV listing or EPSS data accompanies this report.
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is terminated or displaced by a newly established connection, allowing an unauthenticated attacker with adjacent network access (same Wi-Fi/link-layer segment) to potentially reach functionality belonging to the displaced client's session (CWE-613). Exploitation is not internet-remote and is further gated by a race condition: the attacker must connect during the narrow window before the separate session-expiration mechanism invalidates the residual authenticated state, which is why an internal assessment scores the attack complexity as High (CVSS:3.1/AV:A/AC:H/PR:N/UI:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the affected CPE is a wildcard covering all firmware versions.
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (the camera's Wi-Fi/link-local segment) reach privileged, session-gated commands by presenting a session identifier that belongs to a different, already-authenticated client, because the firmware never binds session state to the connection that created it (CWE-863). Successful abuse gives high impact to confidentiality, integrity and availability of the camera itself - full compromise of the device's privileged functionality - though exploitation is not opportunistic: an attacker must be within adjacent-network range and a legitimate client must already hold a live authenticated session whose identifier can be obtained or replayed. The vendor CVSS 4.0 base score is 8.7 (High, AV:A/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H), while our independent CVSS 3.1 assessment rates it AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to reflect the session-hijack precondition; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network segment to submit crafted command data that writes past the bounds of an allocated buffer, potentially corrupting authentication state or terminating the affected process so the device restarts. The result is a temporary denial of service - the device becomes briefly unavailable while it reboots - with no demonstrated path to code execution, privilege escalation, or data disclosure (CVSS 4.0 base 6.9; availability-only impact, adjacent vector, low privileges required, no user interaction). No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the KEV catalog; the issue is reported by ICS-CERT in advisory ICSA-26-267-01.
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communicates using a hard-coded cryptographic key and initialization vector (CWE-321). An attacker who is within adjacent wireless range of the camera, captures the protected credential, and then extracts the key and IV from a firmware image can recover the WiFi password and join the camera's network; no authentication or user interaction is required, though the combination of credential interception and firmware reverse-engineering makes practical exploitation difficult (CVSS 4.0 base 6.0; assessed as AV:A/AC:H/PR:N/UI:N with high confidentiality impact only). Impact is confined to disclosure of the WiFi passphrase and access to the device's own network, with no direct integrity or availability effect on the camera, and no public exploit identified at time of analysis; CISA's ICS-CERT published the finding as ICSA-26-267-01, so deployers of this IoT camera should treat the risk as LOW-to-MODERATE and localized rather than broadly exploitable.
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range read sensitive on-device data - device identifiers, firmware details, and protected WiFi credentials - because the firmware exposes GATT characteristics without requiring authenticated pairing or client binding. The flaw is a missing-authentication condition (CWE-306) that exists in the default device state, so no credentials, user interaction, or special tooling are required; the practical constraint is physical proximity, as there is no internet-reachable attack path. No public exploit code has been identified at time of analysis, and CISA published an ICS advisory (ICSA-26-267-01) covering the product. Because impact is limited to confidentiality (no integrity or availability effect), this is best characterized as a real but physically constrained information-disclosure issue rather than a mass-exploitable network flaw.
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic logs created during the vendor support process, and those logs persist on the removable storage media (microSD card) after the support session ends. An unauthenticated attacker who physically obtains the card can simply read the log files and recover the device's WiFi credentials and other configuration details; per the CVSS 4.0 vector AV:P/PR:N/UI:N this requires physical possession of the media, and there is no network-reachable path to the data. The issue is a confidentiality-only disclosure (CWE-532) with no public exploit identified at time of analysis, and our independent assessment rates it a genuinely low-priority problem whose 5.1 score is driven almost entirely by the physical attack vector rather than any remote reachability.
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video, GPS location, images and diagnostic logs to anyone who can observe the device's WiFi traffic, because the camera exchanges this data with its companion mobile app over unencrypted HTTP and RTSP rather than TLS or encrypted RTSP. The exposure is unauthenticated but adjacent-only (CVSS:4.0 AV:A/AC:L/PR:N, scored 7.1; independently assessed as CVSS:3.1 AV:A/AC:H with confidentiality-only impact), so it requires an attacker within wireless range of, or already joined to, the network the G980H uses to talk to its phone app. No public exploit code has been identified at time of analysis and the issue has not been confirmed as actively exploited (not in CISA KEV); practical risk hinges on how easily the WiFi segment can be reached, which is worse if the camera's access point uses a predictable or default password.
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial interface to obtain full root access, because the password is embedded in the firmware and cannot be changed, rotated, or disabled by the user. Exploitation is physically gated: it requires hands-on access to the camera plus a serial connection, and per the assessed vector (CVSS:3.1 AV:P/AC:L/PR:N/UI:N, CVSS:4.0 base 7.0) there is no prior-privilege or user-interaction barrier once that physical connection is made, while remote or network exploitation is not possible. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is limited to attackers with device custody or those who obtain a firmware image, in which case the exposed credential grants complete control of the device (C:H/I:H/A:H).
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's own WiFi network retrieve files from its removable storage without authentication or user interaction. Readable content includes recordings, images, diagnostic logs and firmware files, which are exactly the artifacts a web server should never expose. CISA's ICS advisory ICSA-26-267-01 tracks the issue as CWE-22 and scores it 7.1 (High), driven entirely by confidentiality impact; proximity is the limiting factor, since the flaw is reachable only from the adjacent network and cannot be triggered from the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper firmware authenticity verification in the Botslab G980H dash camera allows an attacker who can intercept the device's firmware download or supply a crafted update package to install modified firmware and execute unauthorized code on the device. The update process fetches firmware over an unprotected connection and validates only an integrity value delivered alongside the payload rather than a trusted cryptographic signature, so anyone who controls the delivered bytes and recomputes that value defeats the check. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as high severity but with a harder attack path than the vendor-published CVSS 4.0 score of 9.2 suggests, since the attacker needs either an on-path network position between camera and update source or authenticated update-submission access; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the intelligence signals around this advisory remain thin.
Reusable authentication values in Botslab G980H dash camera firmware let an attacker on the adjacent network replay a captured credential from a different client to obtain an authenticated session with privileged device functionality. The vulnerability affects all firmware revisions tracked under CPE cpe:2.3:a:botslab:g980h:*:*:*:*:*:*:*:* and is rated 8.6 under CVSS 4.0 (assessed 8.1 under CVSS 3.1 as AV:A/AC:H/PR:N/UI:N, with high confidentiality and integrity impact and no availability impact). Exploitation is unauthenticated per the vector (PR:N/UI:N) but requires the attacker to already be positioned on the same local network or RF proximity as the camera and its legitimate client, and to capture a valid authentication value before or while it is still usable; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so risk signals are moderate-to-high rather than urgent.
Predictable session identifier generation in the Botslab G980H dash camera allows an unauthenticated attacker on the same adjacent network to enumerate or guess a valid session ID and use it to bypass the device's authorization controls, gaining high-impact read/write access to camera functionality. Exploitation is constrained rather than trivial: the attacker must already be on the same local/link-layer network as the camera and must time the attempt to coincide with a legitimate active session, and the supplied CVSS 4.0 vector reflects that prerequisite via AT:P alongside AV:A, PR:N and UI:N. There is no remote-internet attack path, so this is best characterized as a genuine but not high-priority weakness; no public exploit code has been identified at time of analysis and no CISA KEV listing or EPSS data accompanies this report.
Botslab G980H dash camera firmware can leave a client's authentication state valid after that client's connection is terminated or displaced by a newly established connection, allowing an unauthenticated attacker with adjacent network access (same Wi-Fi/link-layer segment) to potentially reach functionality belonging to the displaced client's session (CWE-613). Exploitation is not internet-remote and is further gated by a race condition: the attacker must connect during the narrow window before the separate session-expiration mechanism invalidates the residual authenticated state, which is why an internal assessment scores the attack complexity as High (CVSS:3.1/AV:A/AC:H/PR:N/UI:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the affected CPE is a wildcard covering all firmware versions.
Session-hijacking authorization bypass in Botslab G980H dash camera firmware lets an attacker on the adjacent network (the camera's Wi-Fi/link-local segment) reach privileged, session-gated commands by presenting a session identifier that belongs to a different, already-authenticated client, because the firmware never binds session state to the connection that created it (CWE-863). Successful abuse gives high impact to confidentiality, integrity and availability of the camera itself - full compromise of the device's privileged functionality - though exploitation is not opportunistic: an attacker must be within adjacent-network range and a legitimate client must already hold a live authenticated session whose identifier can be obtained or replayed. The vendor CVSS 4.0 base score is 8.7 (High, AV:A/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H), while our independent CVSS 3.1 assessment rates it AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H to reflect the session-hijack precondition; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network segment to submit crafted command data that writes past the bounds of an allocated buffer, potentially corrupting authentication state or terminating the affected process so the device restarts. The result is a temporary denial of service - the device becomes briefly unavailable while it reboots - with no demonstrated path to code execution, privilege escalation, or data disclosure (CVSS 4.0 base 6.9; availability-only impact, adjacent vector, low privileges required, no user interaction). No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the KEV catalog; the issue is reported by ICS-CERT in advisory ICSA-26-267-01.
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communicates using a hard-coded cryptographic key and initialization vector (CWE-321). An attacker who is within adjacent wireless range of the camera, captures the protected credential, and then extracts the key and IV from a firmware image can recover the WiFi password and join the camera's network; no authentication or user interaction is required, though the combination of credential interception and firmware reverse-engineering makes practical exploitation difficult (CVSS 4.0 base 6.0; assessed as AV:A/AC:H/PR:N/UI:N with high confidentiality impact only). Impact is confined to disclosure of the WiFi passphrase and access to the device's own network, with no direct integrity or availability effect on the camera, and no public exploit identified at time of analysis; CISA's ICS-CERT published the finding as ICSA-26-267-01, so deployers of this IoT camera should treat the risk as LOW-to-MODERATE and localized rather than broadly exploitable.
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range read sensitive on-device data - device identifiers, firmware details, and protected WiFi credentials - because the firmware exposes GATT characteristics without requiring authenticated pairing or client binding. The flaw is a missing-authentication condition (CWE-306) that exists in the default device state, so no credentials, user interaction, or special tooling are required; the practical constraint is physical proximity, as there is no internet-reachable attack path. No public exploit code has been identified at time of analysis, and CISA published an ICS advisory (ICSA-26-267-01) covering the product. Because impact is limited to confidentiality (no integrity or availability effect), this is best characterized as a real but physically constrained information-disclosure issue rather than a mass-exploitable network flaw.
Botslab G980H dash camera firmware writes sensitive configuration data - including WiFi credentials - into diagnostic logs created during the vendor support process, and those logs persist on the removable storage media (microSD card) after the support session ends. An unauthenticated attacker who physically obtains the card can simply read the log files and recover the device's WiFi credentials and other configuration details; per the CVSS 4.0 vector AV:P/PR:N/UI:N this requires physical possession of the media, and there is no network-reachable path to the data. The issue is a confidentiality-only disclosure (CWE-532) with no public exploit identified at time of analysis, and our independent assessment rates it a genuinely low-priority problem whose 5.1 score is driven almost entirely by the physical attack vector rather than any remote reachability.