CISA published an advisory on September 29 covering two flaws in the Viidure Dashcam Android application, a companion app for a Chinese-made camera sold worldwide. Both sit in the platform behind the app, not in the camera itself.
The first is a cloud storage bucket set to public read. Because that bucket holds shared objects for the whole service, anyone on the internet can pull user records, live footage, application packages and firmware files straight out of it. CISA filed the flaw as CVE-2026-94204 and scored it 7.5.
The second is worse. The Android app embeds permanent, plaintext cloud credentials inside its compiled code. Those keys carry full rights over the same storage, including the power to read, modify or delete firmware and application binaries. That is CVE-2026-96587, rated 10.0 critical. An attacker who swaps a firmware image decides what lands on every camera that updates.
Every build up to 3.3.1.260403 is affected. Viidure did not answer CISA’s coordination attempts, and the advisory records no fix planned. CISA’s only guidance is to contact the vendor. Researcher Bugrahan Karahan reported both issues.
A dashcam sits in the cabin, wired near the head unit and often sharing its network. That is why CISA files the device under the transportation sector rather than the gadget aisle. A platform that hands out its storage keys turns a cheap accessory into a way into the vehicle.
