Botslab G980H Dashcams Missing Authentication for Critical Function

Why this deserves its current priority

CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Botslab/G980H (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Botslab/G980H.
2. 2Review the reported fix. Source-reported workaround: Botslab has not responded to requests to work with CISA to mitigate this vulnerability. Users of affected versions of G980H Dashcams are invited to reach out to Botslab for more information: https://www.botslab.com/pages/about-botslab

Evidence timeline and material changes

1. Published upstream

   Sep 24, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 24, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 25, 2026

Sources and claim methodology

• GitHub security advisorygithub.com
• Source referencebotslab.com
• CISA Known Exploited Vulnerabilities catalogcisa.gov

Related CVEs

• Botslab G980H Dashcams Use of Hard-coded Cryptographic KeySame botslab/g980h package
• Botslab G980H Dashcams Authentication Bypass by Capture-replaySame botslab/g980h package
• Botslab G980H Dashcams Use of Hard-coded CredentialsSame botslab/g980h package
• Botslab G980H Dashcams Insufficient Verification of Data AuthenticitySame botslab/g980h package
• Botslab G980H Dashcams Insufficient session expirationSame botslab/g980h package
• Botslab G980H Dashcams Cleartext Transmission of Sensitive InformationSame botslab/g980h package