Thirteen vulnerabilities sit unpatched in Botslab’s G980H dash camera, and the vendor has not answered CISA’s requests to help close them. CISA published advisory ICSA-26-267-01 on September 24 and rated the cluster 8.8 under CVSS v3, filing the device under the transportation sector.
Session handling carries the worst of the set. CVE-2026-84399 lets one client reuse another connection’s authenticated session, so privileged commands run without checking who is asking. CVE-2026-82566 keeps that state alive after a connection dies, and CVE-2026-85496 builds session identifiers from a small sequential pool that an attacker on the same network can walk through.
Two more need no guesswork. CVE-2026-77967 accepts a captured authentication value a second time, from a different client. CVE-2026-88761 derives the default WiFi password from device details the camera itself broadcasts, leaving few characters to brute force.
Physical access is worse. Firmware 58_QHG980HMCN5291SysFW+ exposes a root account over UART with no password at all (CVE-2026-88956), and that interface prints the WiFi password during startup. Support logs left on removable storage carry stored credentials for anyone who pulls the card (CVE-2026-82716).
The rest cover hard-coded cryptographic keys, a path traversal, out-of-bounds writes, cleartext transmission and weak credentials. Affected units run firmware 30010_QHG980HN5294SysFW+ or 58_QHG980HMCN5291SysFW+. The advisory’s only mitigation is for owners to contact the vendor directly. A dash camera sits inside the cabin on the same wiring, and often the same network, as the head unit, which turns a camera that hands out root access into a vehicle problem rather than a gadget one.
