Botslab G980H Dashcams Hit by 13 High-Severity Flaws
CISA published the advisory after the Chinese vendor went silent on mitigation requests, leaving transportation operators to self-defend.
TL;DR
CISA published an advisory for 13 vulnerabilities in Botslab G980H dashcams, CVSS scores reaching 8.8, affecting firmware versions deployed in transportation critical infrastructure worldwide. The flaws span session hijacking, authentication bypass via replay, predictable session identifiers, weak default WiFi passwords, hard-coded credentials, and a root shell accessible over UART without a password. Botslab hasn't responded to CISA's requests to coordinate mitigation. No vendor fix is currently available. Organizations with these units in fleet or municipal deployments should assume the devices are reachable on-adjacent-network and limit exposure accordingly.
Thirteen vulnerabilities in Botslab G980H dashcams were disclosed by CISA this week, and the common thread isn't one coding mistake, it's that authentication on these devices was designed as though the WiFi network around a vehicle is a trusted perimeter. It isn't.
The advisory covers two firmware branches (30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+) deployed worldwide in the transportation sector. Botslab is headquartered in China. CISA reports the company hasn't responded to requests to work on mitigation. Users are directed to contact Botslab directly for more information. The subtext: don't hold your breath.
What the flaws actually allow
The vulnerability set reads like a checklist of authentication failures. CVE-2026-84399: the firmware associates privileged operations with possession of a session identifier but doesn't validate that the requesting client is the one that authenticated, so an adjacent attacker can hijack another client's session. CVE-2026-82566: sessions outlive their connections, remaining valid after the original client disconnects. CVE-2026-85496: session identifiers are generated from a small sequential space rather than a random source, making them guessable. CVE-2026-77967: authentication values can be captured and replayed from a different client without freshness checks. CVE-2026-88761: the default WiFi password is derived from predictable device information, some of which the device advertises, an attacker within range can brute-force the remainder.
Further in, CVE-2026-88956 exposes a root account on the UART interface that requires no password and surfaces the WiFi credentials on connection. Hard-coded cryptographic keys (CVE-2026-82708), hard-coded credentials (CVE-2026-84403), cleartext transmission of sensitive information (CVE-2026-81630), and an out-of-bounds write (CVE-2026-87118) round out the list.
All CVEs require adjacent network access. The attack vector in every case is AV:A. So the threat model is someone within WiFi range of a vehicle, a parking lot, a depot, a fleet yard. That's not exotic.
What's missing
CISA's advisory explicitly states Botslab has not responded. There's no patch timeline, no workaround guidance from the vendor, and no indication of which firmware versions might receive fixes or whether affected hardware is still supported. In the ICS advisory format, that's about as pointed as CISA gets without saying "assume end-of-life." Operators should do exactly that until Botslab demonstrates otherwise.
The transportation-sector designation matters. Dashcams in fleet vehicles often sit on the same network segment as telematics gateways, electronic logging devices, or maintenance-diagnostic interfaces. A compromised dashcam becomes a pivot point, not just a privacy problem. Anyone running these units in a municipal fleet or a contractor-operated logistics chain should inventory them now, and treat them as untrusted endpoints on whatever network they're attached to.
Published ·Deep Fathom