6 minhigh
Botslab G980H Dashcams (CVE-2026-84399, CVE-2026-82566, CVE-2026-85496 +11 more)
Fourteen unpatched vulnerabilities in Botslab G980H dashcams allow adjacent WiFi, Bluetooth, and physical attackers to bypass authentication, steal credentials, and execute code. Fourteen CVEs in Botslab G980H dashcams enable authentication bypass, credential theft, path traversal, firmware tampering, and denial of service. Attack vectors include adjacent WiFi, Bluetooth range, and physical UART access. The vendor has not responded to CISA, and no patch is available.
Sens:▲ 24hConf:high
IOCs14
14cve
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Isolate Botslab G980H dashcams from internet and business networks immediately
- Restrict physical access to dashcam devices and removable storage media
- Change default WiFi password to a strong, unique value
- Disable Bluetooth if not required for dashcam operation
Key Takeaways
- 14 CVEs span session hijacking, credential exposure, path traversal, and unsigned firmware update flaws
- Two firmware versions affected; CVE-2026-88956 and CVE-2026-79959 are version-specific
- CVE-2026-81630 scores 9.2 critical (CVSS v4.0) for unsigned firmware update over unencrypted connection
- Vendor Botslab has not responded to CISA; no patch available as of 2026-09-24
- Reported by Julian of Software Secured; no known public exploitation reported
Attack Chain
- Reconnaissance: Attacker identifies Botslab G980H dashcam within WiFi, Bluetooth, or physical proximity
- Initial Access: Attacker exploits session hijacking, predictable WiFi password, or BLE to access device
- Privilege Escalation: Attacker uses hard-coded root password or passwordless UART for root shell
- Collection: Attacker retrieves recordings, WiFi credentials, and logs via path traversal or cleartext interception
- Persistence: Attacker installs modified unsigned firmware for persistent code execution and device control
Affected Systems
- Botslab G980H dashcam firmware 30010_QHG980HN5294SysFW+
- Botslab G980H dashcam firmware 58_QHG980HMCN5291SysFW+
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-84399 | Botslab G980H Dashcam | High | Session not bound to client; adjacent attacker reuses valid session for privileged access. |
| CVE-2026-82566 | Botslab G980H Dashcam | High | Session remains valid after client disconnect; attacker exploits residual authentication state. |
| CVE-2026-85496 | Botslab G980H Dashcam | High | Predictable sequential session IDs; attacker guesses valid session identifier. |
| CVE-2026-77967 | Botslab G980H Dashcam | High | Reusable auth values; attacker replays captured credentials from another client. |
| CVE-2026-88761 | Botslab G980H Dashcam | Medium | Default WiFi password derived from predictable, partially advertised device information. |
| CVE-2026-88956 | Botslab G980H Dashcam | Medium | UART root account requires no password; exposes WiFi password at startup. |
| CVE-2026-82716 | Botslab G980H Dashcam | Medium | Diagnostic logs with WiFi credentials left on removable storage. |
| CVE-2026-84403 | Botslab G980H Dashcam | Medium | BLE communications require no pairing; exposes WiFi credentials and device info. |
| CVE-2026-75558 | Botslab G980H Dashcam | Medium | Hard-coded crypto key and IV protect WiFi credentials in firmware. |
| CVE-2026-81630 | Botslab G980H Dashcam | High | Unsigned firmware updates over unencrypted connection; allows arbitrary code execution. |
| CVE-2026-87118 | Botslab G980H Dashcam | Medium | Out-of-bounds write in command processing causes denial of service or restart. |
| CVE-2026-82708 | Botslab G980H Dashcam | Medium | HTTP server path traversal exposes recordings, logs, and firmware files. |
| CVE-2026-79959 | Botslab G980H Dashcam | Medium | Hard-coded root password cannot be changed; accessible via UART interface. |
| CVE-2026-82585 | Botslab G980H Dashcam | Medium | Sensitive data transmitted over unencrypted HTTP and RTSP connections. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | IoT dashcam devices have no endpoint agent; EDR cannot monitor firmware or BLE. |
| Network Visibility | Medium | Cleartext HTTP/RTSP and WiFi traffic observable on adjacent segments; BLE is not. |
| Detection Difficulty | Hard | IoT devices lack logging; adjacent network and physical access vectors evade standard endpoint detection. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| HTTP requests containing path traversal sequences targeting dashcam web servers indicate exploitation of CVE-2026-82708 (T1190) | HTTP server logs, web proxy logs | Initial Access | Low — path traversal to dashcams is anomalous |
| Sequential or predictable session identifiers in HTTP requests suggest session hijacking on dashcam devices (T1550.001) | HTTP session logs, network appliance logs | Defense Evasion | Medium — legitimate sessions may use sequential IDs |
| Unauthenticated BLE connections to dashcam devices without prior pairing expose WiFi credentials (T1552) | Bluetooth connection logs, wireless controller logs | Collection | Low — unprompted BLE sessions are suspicious |
Required Log Sources
- Network firewall logs
- WiFi authentication logs
- Bluetooth connection logs
- HTTP server access logs
- IDS/IPS alerts
- Network traffic analysis
Key Behavioral Indicators
- HTTP requests with path traversal sequences to dashcam web server
- Sequential session ID values in dashcam HTTP requests
- Unauthenticated BLE connections to dashcam GATT characteristics
- Cleartext HTTP or RTSP streams on dashcam WiFi network
- Firmware download requests over unencrypted connections to dashcam
- Root login via UART without password challenge
Control Gaps
- No endpoint detection agent on IoT dashcam devices
- Adjacent WiFi network traffic not monitored for session hijacking
- Bluetooth connections not logged or access-controlled on IoT devices
- Unsigned firmware updates not blocked or integrity-verified
- UART physical access not restricted or monitored
False Positive Assessment
Low — specific CVEs in a named product with no behavioral detection rules or signatures to trigger false positives.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Place dashcam WiFi networks behind firewalls, isolated from all other systems
- Monitor HTTP requests to dashcam web servers for path traversal patterns
- Use VPN for any required remote access to dashcam networks
- Segment dashcam WiFi to prevent interception of cleartext HTTP and RTSP traffic
User Protection
- Remove diagnostic logs from removable storage after support operations complete
- Rotate WiFi credentials after any physical service or support event
- Inspect firmware update packages for signs of tampering before installation
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping8 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Credential Access
Tactic
Lateral Movement
Tactic
Impact
Plain-Language Summary
Botslab G980H dashcams have 14 security flaws allowing nearby attackers to bypass login, steal WiFi passwords, view recordings, or install malicious firmware. The cameras are used in transportation systems worldwide. The manufacturer has not provided fixes. Users should disconnect cameras from public networks, limit physical and Bluetooth access, change default WiFi passwords, and remove diagnostic logs from storage cards.
Showing defanged values
- cveCVE-2026-75558Hard-coded crypto key and IV protect WiFi credentials in firmware.
- cveCVE-2026-77967Reusable auth values; attacker replays captured credentials from another client.
- cveCVE-2026-79959Hard-coded root password cannot be changed; accessible via UART interface.
- cveCVE-2026-81630Unsigned firmware updates over unencrypted connection; allows arbitrary code execution.
- cveCVE-2026-82566Session remains valid after client disconnect; attacker exploits residual authentication state.
- cveCVE-2026-82585Sensitive data transmitted over unencrypted HTTP and RTSP connections.
- cveCVE-2026-82708HTTP server path traversal exposes recordings, logs, and firmware files.
- cveCVE-2026-82716Diagnostic logs with WiFi credentials left on removable storage.
- cveCVE-2026-84399Session not bound to client; adjacent attacker reuses valid session for privileged access.
- cveCVE-2026-84403BLE communications require no pairing; exposes WiFi credentials and device info.
- cveCVE-2026-85496Predictable sequential session IDs; attacker guesses valid session identifier.
- cveCVE-2026-87118Out-of-bounds write in command processing causes denial of service or restart.
- cveCVE-2026-88761Default WiFi password derived from predictable, partially advertised device information.
- cveCVE-2026-88956UART root account requires no password; exposes WiFi password at startup.
Related
Stay currentSubscribe via RSS