Botslab G980H Dashcams
CISA details multiple high-severity flaws in Botslab G980H dashcams that can bypass authentication over adjacent Wi-Fi.
CISA advisory ICSA-26-267-01 covers multiple vulnerabilities in Botslab G980H dashcam firmware builds 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+. Successful exploitation could let an adjacent-network attacker bypass authentication, read sensitive data, change configuration, and disrupt the device. Detailed issues include incorrect authorization, lingering sessions, predictable session identifiers, authentication replay, and a guessable default Wi-Fi password, with CVSS v3.1 scores up to 8.8. The transportation-sector product is deployed worldwide and the vendor is headquartered in China; the advisory does not report exploitation in the wild.
- CISA published ICSA-26-267-01 covering Botslab G980H dashcam firmware flaws.
- Several issues score CVSS 8.8 and allow adjacent unauthenticated access to privileged functions.
- Weaknesses include predictable sessions, auth replay, hardcoded secrets, and path traversal.
- Two firmware strings are affected; the advisory does not report active exploitation.
- CVEs
- CVE-2026-75558CVE-2026-77967CVE-2026-79959CVE-2026-81630CVE-2026-82566CVE-2026-82585CVE-2026-82708CVE-2026-82716CVE-2026-84399CVE-2026-84403CVE-2026-85496CVE-2026-87118CVE-2026-88761CVE-2026-88956
- Vendors
- Botslab
- Products
- Botslab G980H
- Organizations
- CISA
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75558 | The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device | 6.0 | — | ||
| CVE-2026-82566 | Stale Session Reuse in Botslab G980H Dashcam Firmware (CWE-613) | 8.7 group max | — | ||
| CVE-2026-79959 | The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user | 7.0 | — | ||
| CVE-2026-81630 | The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates | 9.2 | — | ||
| CVE-2026-82716 | The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the… | 5.1 | — | ||
| CVE-2026-84403 | The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications… | 6.9 | — | ||
| CVE-2026-87118 | The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality | 6.9 | — |
From the original article
9 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data and privileged device functionality, modify device configuration, disrupt device operation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.