CVE-2026-84399

The Botslab G980H dash camera firmware does not tie an authenticated session to the client connection that established it, so privileged commands are authorized based only on possession of a valid session identifier (CWE-863, incorrect authorization). An unauthenticated attacker with adjacent network access - for example within range of the camera's Wi-Fi hotspot or on the same local network - can reuse valid session state belonging to another client, such as the owner's paired phone, to invoke privileged functionality. The flaw carries a CVSS 4.0 score of 8.7 with high impact to confidentiality, integrity, and availability of the device, effectively granting full privileged control of the camera. Only owners of the G980H model are affected, and exploitation requires network proximity rather than internet exposure, since the attack vector is adjacent-network. There is no known public proof of concept, the CVE is not on the CISA KEV list, and no exploitation has been observed.

What to do: Check the Botslab vendor site and companion app for a firmware update, as the advisory lists no fixed version. Until patched, disable the camera's Wi-Fi hotspot and Bluetooth when not actively in use and set a strong, unique hotspot password, since exploitation requires an attacker on the same adjacent network. Avoid pairing or operating the camera in high-density settings where a nearby attacker could share the network and replay a valid session.