Multiple Critical Vulnerabilities Discovered in Botslab G980H Dashcam Firmware

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-267-01 on September 24, 2026, disclosing 13 vulnerabilities affecting the Botslab G980H Dashcam product line. The affected firmware versions are 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+.

The vulnerability set includes issues such as incorrect authorization (CWE-863), insufficient session expiration (CWE-613), generation of predictable numbers or identifiers (CWE-338), authentication bypass by capture-replay, use of weak credentials, insertion of sensitive information into log files, use of hard-coded cryptographic keys, insufficient verification of data authenticity, out-of-bounds writes, and path traversal.

According to the advisory, successful exploitation could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data and privileged device functionality, modify device configuration, and disrupt device operation. CVSS base scores reach 8.8, with the vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products span the G980H dash cam series with the two firmware versions listed above. The vendor, Botslab, has not responded to requests to coordinate mitigation with CISA. Users are directed to the vendor's about page for additional information. No official patch or mitigation guidance has been publicly confirmed at the time of this advisory.