CISA Lists 14 Botslab Dashcam Flaws With No Fix in Sight
Security / news
CISA Lists 14 Botslab Dashcam Flaws With No Fix in Sight
The worst of the bugs lets a network attacker push firmware with no cryptographic signature onto the device, and Botslab has not told CISA whether it plans to fix any of the 14.
CISA published 14 vulnerabilities in the firmware of Botslab's G980H dashcam on Sept. 24, and the advisory that lists them says the manufacturer has not engaged with the agency on fixing any. No patched firmware version exists for either affected build, and CISA's own guidance is limited to isolating the devices on a network rather than updating them.
The flaws span two firmware families sold under the G980H name, tracked internally by Botslab as 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+. Thirteen of the 14 apply to both; the 14th, CVE-2026-79959, a hard-coded root password that cannot be changed, is specific to the 30010 build.
The score that matters most here
The highest-rated flaw, CVE-2026-81630, scores 8.1 under CVSS 3.1 but 9.2, a critical rating, under CISA's newer CVSS 4.0 metric. The bug is in how the dashcam checks its own firmware updates: the device fetches new firmware over an unprotected connection and verifies it against an integrity value bundled with the download rather than a cryptographic signature it cannot forge. An attacker positioned on the same network as the device during an update can substitute their own firmware, and the dashcam has no way to tell the difference.
Three more bugs cluster around session handling. CVE-2026-84399 lets an attacker guess a valid session identifier because the values are drawn from a small, sequential range rather than a random one. CVE-2026-82566 lets a terminated session's authentication state stay valid after the legitimate client disconnects. CVE-2026-77967 accepts a captured authentication value a second time without checking whether it has already been used. Each carries a CVSS 3.1 score of 8.1 to 8.8, and each requires only that an attacker share network access with the camera, not physical possession of it.
The bugs that need a screwdriver, not a network
Two flaws require physical or short-range access instead. CVE-2026-88956 exposes a root account with no password over the device's UART hardware interface, the serial connection used for diagnostics, and prints the device's Wi-Fi password to that interface on startup. CVE-2026-84403 lets anyone within Bluetooth range connect to the camera's Bluetooth Low Energy interface without pairing, which is enough to retrieve the same Wi-Fi credentials.
| CVE | CVSS 3.1 | Flaw |
|---|---|---|
| CVE-2026-81630 | 8.1 | Firmware updates accepted without a cryptographic signature |
| CVE-2026-84399 | 8.8 | Session identifiers guessable from a small numeric range |
| CVE-2026-82566 | 8.8 | Session stays valid after the client disconnects |
| CVE-2026-77967 | 8.1 | Captured authentication values accepted a second time |
| CVE-2026-88956 | 6.8 | Passwordless root account reachable over UART |
No patch, and no answer from the vendor
CISA's advisory states plainly that Botslab has not responded to the agency's attempts to coordinate a fix. Botslab's own security-advisory page, checked Sept. 26, says the company will "release the formal security advisory" once a reported issue is confirmed and fixed. Two days after CISA's disclosure, that page carries no mention of any of the 14 CVE identifiers, and no firmware update addressing them is listed on Botslab's site.
The researcher CISA credits with finding the bugs is identified in the advisory only as Julian, of Software Secured, an Ottawa-based firm whose chief executive and founder, Sherif Koussa, describes it on the company's own site as a manual penetration-testing shop for business software vendors. CISA has not said whether Software Secured found the flaws during a client engagement or independent research.
With no patch available, CISA's mitigation advice is defensive rather than corrective: isolate the dashcam's network segment behind a firewall, minimize its exposure to the open internet, and use a VPN for any remote access rather than exposing the device's web interface directly. Network isolation, firewalls and a VPN for remote access is advice aimed at reducing exposure, not at fixing anything. It is the same category of unresolved hardware disclosure as a Hitachi Energy platform CISA rated 9.9 with no patch version at all and a universal hard-coded key CISA found in Flock Safety's license-plate cameras. For G980H owners, for now, network isolation is all there is.
Sources
- 03About Us
More in Security
- 01CISA Gives Agencies 3 Days to Patch an Exploited SharePoint BugMicrosoft rated the flaw a low-risk spoofing issue for 16 days after patching it, and a honeypot logged the first attack four weeks after the correction upgraded it to an 8.8.
- 02CISA Adds a Fourth MikroTrick Bug to Its Exploited ListCVE-2026-67279 joins two other bugs from the same six-flaw MikroTik batch already on CISA's list, but Bishop Fox says it, not the pair flagged in September, is the one that actually opens the door.
- 03OpenClaw's New Scanners Agree on Just 0.69% of Risky SkillsFour audits since February have counted between 341 and 1,467 malicious or flawed skills on ClawHub, and NVIDIA's scanner disagrees with the other two on all but 468 of 67,453 skills checked.
- 04ShinyHunters Claims a PeopleSoft Zero-Day Breached the FBIThe extortion group says it took 2 to 3 terabytes of personnel data on the night of Sept. 21, but the bureau has confirmed only that it is investigating a claim.