CVE-2026-88956: Botslab G980H Dashcam multiple authentication and authorization flaws

CVE-2026-88956 · Severity: high · CVSS 8.8 · Published 2026-09-24

Botslab G980H dashcams, used to record and monitor vehicle activity, contain multiple critical authentication and authorization vulnerabilities that allow attackers to bypass security controls without credentials. An attacker with network access to the device can exploit weak session management, predictable passwords, and lack of proper access controls to gain full administrative control, access sensitive video footage and device settings, and modify or disable the camera. These issues affect dashcams deployed worldwide in critical transportation infrastructure.

Vendors: Botslab.

Quick answers

Is CVE-2026-88956 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88956 being exploited in the wild.
How severe is CVE-2026-88956?
High severity, with a CVSS score of 8.8, published 24 September 2026.
Which products and versions are affected?
Botslab G980H Dashcam 30010_QHG980HN5294SysFW+, 58_QHG980HMCN5291SysFW+.
Is there a fix for CVE-2026-88956?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88956 attacked?
It is attacked over the network or from the adjacent network, in a network appliance.
Am I affected by CVE-2026-88956?
Check whether you run Botslab G980H Dashcam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Botslab G980H firmware contains a cluster of authentication and authorization flaws spanning CWE-863 (Incorrect Authorization), CWE-613 (Insufficient Session Expiration), CWE-340 (Predictable Session IDs), CWE-294 (Replay attacks), and related weaknesses. Vulnerabilities include: inadequate session-to-client binding allowing reuse of valid sessions by other clients; insufficient session expiration permitting displaced clients to maintain valid authentication; sequential/predictable session identifier generation; acceptance of replayable authentication tokens without freshness validation; default WiFi passwords derived from predictable device information; and hard-coded credentials. An unauthenticated attacker with adjacent network access (WiFi or wired LAN) can exploit these flaws without user interaction to bypass authentication, establish authorized sessions, and access privileged functionality including configuration modification and sensitive data. The vendor has not engaged with CISA on remediation and no patches are currently available. The CVSS v3.1 base score of 8.8 (High) reflects high impact on confidentiality, integrity, and availability.

Affected products

  • Botslab G980H Dashcam 30010_QHG980HN5294SysFW+, 58_QHG980HMCN5291SysFW+

Identifiers

  • CVE-2026-88956
  • CVE-2026-82585
  • CVE-2026-87118
  • CVE-2026-79959
  • CVE-2026-84399
  • CVE-2026-81630
  • CVE-2026-84403
  • CVE-2026-82716
  • CVE-2026-82566
  • CVE-2026-75558
  • CVE-2026-82708
  • CVE-2026-88761
  • CVE-2026-77967
  • CVE-2026-85496

Timeline

  • 2026-09-24: disclosed: CISA ICS Advisory ICSA-26-267-01 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.