CISA discloses 13 flaws in Botslab G980H dashcams
CISA warns Botslab G980H dashcam firmware has 13 vulnerabilities including hardcoded credentials, unsigned firmware updates and cleartext data transmission; vendor is unresponsive.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 14 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory detailing 13 vulnerabilities in Botslab G980H dash camera firmware (series 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+), reported by a researcher at Software Secured. The flaws span weak session management (predictable/reusable session identifiers, session fixation, replay of authentication tokens), a predictable default WiFi password, an unauthenticated root shell over UART that also displays the WiFi password, sensitive credentials logged in plaintext support diagnostics, unauthenticated BLE access exposing device identifiers and WiFi credentials, a hardcoded cryptographic key protecting WiFi credentials, an unauthenticated/unsigned firmware update process that could allow arbitrary code execution, an out-of-bounds write in command processing leading to denial of service, HTTP path traversal exposing recordings/logs/firmware, a hardcoded root password, and cleartext transmission of video, location and diagnostic data over HTTP/RTSP.
Combined, these issues allow attackers with adjacent network, WiFi, Bluetooth or physical access to bypass authentication, exfiltrate recordings and credentials, tamper with device configuration, install malicious firmware, or crash the device. Botslab has not engaged with CISA to develop fixes, so no patched firmware is currently available. CISA states no in-the-wild exploitation has been observed. Because these are consumer/fleet dashcams rather than industrial control equipment, real-world impact is centered on the transportation sector's vehicle telematics and surveillance use cases; defenders operating fleets with these devices should isolate device WiFi/BLE interfaces, avoid exposing device web/RTSP services to untrusted networks, and monitor for anomalous firmware update attempts.
Mentioned in this report
Detection guidance
Unencrypted HTTP Session or Credential Transmission from Botslab G980H
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects cleartext HTTP transmission of sensitive data (video, location, credentials, diagnostics) from Botslab G980H dashcams, indicating exploitation of weak encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unencrypted HTTP Session or Credential Transmission from Botslab G980H
description: Detects HTTP (non-HTTPS) traffic from Botslab G980H dashcams transmitting
sensitive data such as video streams, location, diagnostic logs, or credential materials.
Flags cleartext transmission of WiFi credentials or session tokens over HTTP/RTSP.
tags:
- attack.exfiltration
- attack.t1040
logsource:
category: network_connection
product: windows
detection:
selection_botslab_http:
DestinationHostname|contains:
- g980h
- botslab
DestinationPort:
- 80
- 554
selection_sensitive_protocol:
Protocol|contains:
- http
- rtsp
filter_https:
DestinationPort: 443
condition: (selection_botslab_http and selection_sensitive_protocol) and not filter_https
falsepositives:
- Legacy dashcam deployments intentionally configured for HTTP only
- Local network diagnostic sessions within isolated vehicle networks
level: medium
id: c6d935fa-37ad-510d-842d-c80220faf9cb
status: experimental
author: Vorant
Botslab G980H Unauthenticated Root Shell Access via UART or BLE
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects attempts to access the unauthenticated root shell exposed on Botslab G980H dashcams via UART or Bluetooth Low Energy interfaces without credential validation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Botslab G980H Unauthenticated Root Shell Access via UART or BLE
description: Detects exploitation of the unauthenticated root shell vulnerability
in Botslab G980H dashcams exposed via UART serial interface or BLE, allowing direct
command execution. Targets serial port enumeration, UART debugging tools, or BLE
pairing without authentication.
tags:
- attack.lateral-movement
- attack.t1021.001
logsource:
category: process_creation
product: windows
detection:
selection_serial_tools:
Image|endswith:
- \putty.exe
- \teraterm.exe
- \minicom
- \screen.exe
CommandLine|contains:
- COM
- /dev/ttyUSB
- /dev/ttyACM
selection_ble_tools:
Image|endswith:
- \bluetoothctl
- \gatttool
- \hcitool
filter_legitimate_debug:
CommandLine|contains:
- debug
- manufacturer
condition: (selection_serial_tools or selection_ble_tools) and not filter_legitimate_debug
falsepositives:
- Authorized hardware debugging or maintenance of vehicle dashcams
- OEM diagnostic tools accessing device serial interfaces
level: medium
id: 4113b764-7dba-5317-9e63-a75e8285e4ec
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs