CVE-2026-82585

The Botslab G980H dash camera firmware transmits sensitive data—including stored recordings, live video over RTSP, GPS location, images, and diagnostic logs—over unencrypted HTTP and RTSP connections between the camera and its companion mobile app. An attacker who can intercept traffic on the camera's WiFi network (for example, the camera's own hotspot or a shared network it joins) can passively capture this data with no credentials and no user interaction, exposing live and recorded video, audio, and location history. Only owners of the G980H model and the passengers/networks around them are affected, and impact is limited to confidentiality. There is no known public proof of concept, no confirmed exploitation in the wild, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog.

What to do: Check the Botslab mobile app and vendor site for a firmware update for the G980H and apply it promptly, since no fixed version is listed in the advisory. In the meantime, avoid pairing the camera or streaming on shared or public WiFi, change any default hotspot/app credentials, and disable live viewing when not needed. Treat video, audio, and GPS data as potentially interceptable by anyone within WiFi range until a patched firmware is confirmed installed.