# CISA discloses 13 flaws in Botslab G980H dashcams

Published: 2026-09-24 · Severity: routine · Sectors: transportation
Canonical: https://vorant.io/reports/6780dfc4-60e5-5ba0-9865-cdfe9b176f86/cisa-discloses-13-flaws-in-botslab-g980h-dashcams

> CISA warns Botslab G980H dashcam firmware has 13 vulnerabilities including hardcoded credentials, unsigned firmware updates and cleartext data transmission; vendor is unresponsive.

CISA published an ICS advisory detailing 13 vulnerabilities in Botslab G980H dash camera firmware (series 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+), reported by a researcher at Software Secured. The flaws span weak session management (predictable/reusable session identifiers, session fixation, replay of authentication tokens), a predictable default WiFi password, an unauthenticated root shell over UART that also displays the WiFi password, sensitive credentials logged in plaintext support diagnostics, unauthenticated BLE access exposing device identifiers and WiFi credentials, a hardcoded cryptographic key protecting WiFi credentials, an unauthenticated/unsigned firmware update process that could allow arbitrary code execution, an out-of-bounds write in command processing leading to denial of service, HTTP path traversal exposing recordings/logs/firmware, a hardcoded root password, and cleartext transmission of video, location and diagnostic data over HTTP/RTSP.

Combined, these issues allow attackers with adjacent network, WiFi, Bluetooth or physical access to bypass authentication, exfiltrate recordings and credentials, tamper with device configuration, install malicious firmware, or crash the device. Botslab has not engaged with CISA to develop fixes, so no patched firmware is currently available. CISA states no in-the-wild exploitation has been observed. Because these are consumer/fleet dashcams rather than industrial control equipment, real-world impact is centered on the transportation sector's vehicle telematics and surveillance use cases; defenders operating fleets with these devices should isolate device WiFi/BLE interfaces, avoid exposing device web/RTSP services to untrusted networks, and monitor for anomalous firmware update attempts.

## Mentioned in this report

- Vulnerabilities: CVE-2026-75558, CVE-2026-77967, CVE-2026-79959, CVE-2026-81630, CVE-2026-82566, CVE-2026-82585, CVE-2026-82708, CVE-2026-82716, CVE-2026-84399, CVE-2026-84403, CVE-2026-85496, CVE-2026-87118, CVE-2026-88761, CVE-2026-88956

## Detection guidance (public sample)

### Unencrypted HTTP Session or Credential Transmission from Botslab G980H

ATT&CK: T1040

Detects cleartext HTTP transmission of sensitive data (video, location, credentials, diagnostics) from Botslab G980H dashcams, indicating exploitation of weak encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unencrypted HTTP Session or Credential Transmission from Botslab G980H
description: Detects HTTP (non-HTTPS) traffic from Botslab G980H dashcams transmitting
  sensitive data such as video streams, location, diagnostic logs, or credential materials.
  Flags cleartext transmission of WiFi credentials or session tokens over HTTP/RTSP.
tags:
- attack.exfiltration
- attack.t1040
logsource:
  category: network_connection
  product: windows
detection:
  selection_botslab_http:
    DestinationHostname|contains:
    - g980h
    - botslab
    DestinationPort:
    - 80
    - 554
  selection_sensitive_protocol:
    Protocol|contains:
    - http
    - rtsp
  filter_https:
    DestinationPort: 443
  condition: (selection_botslab_http and selection_sensitive_protocol) and not filter_https
falsepositives:
- Legacy dashcam deployments intentionally configured for HTTP only
- Local network diagnostic sessions within isolated vehicle networks
level: medium
id: c6d935fa-37ad-510d-842d-c80220faf9cb
status: experimental
author: Vorant
```

### Botslab G980H Unauthenticated Root Shell Access via UART or BLE

ATT&CK: T1021.001

Detects attempts to access the unauthenticated root shell exposed on Botslab G980H dashcams via UART or Bluetooth Low Energy interfaces without credential validation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Botslab G980H Unauthenticated Root Shell Access via UART or BLE
description: Detects exploitation of the unauthenticated root shell vulnerability
  in Botslab G980H dashcams exposed via UART serial interface or BLE, allowing direct
  command execution. Targets serial port enumeration, UART debugging tools, or BLE
  pairing without authentication.
tags:
- attack.lateral-movement
- attack.t1021.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_serial_tools:
    Image|endswith:
    - \putty.exe
    - \teraterm.exe
    - \minicom
    - \screen.exe
    CommandLine|contains:
    - COM
    - /dev/ttyUSB
    - /dev/ttyACM
  selection_ble_tools:
    Image|endswith:
    - \bluetoothctl
    - \gatttool
    - \hcitool
  filter_legitimate_debug:
    CommandLine|contains:
    - debug
    - manufacturer
  condition: (selection_serial_tools or selection_ble_tools) and not filter_legitimate_debug
falsepositives:
- Authorized hardware debugging or maintenance of vehicle dashcams
- OEM diagnostic tools accessing device serial interfaces
level: medium
id: 4113b764-7dba-5317-9e63-a75e8285e4ec
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6780dfc4-60e5-5ba0-9865-cdfe9b176f86/cisa-discloses-13-flaws-in-botslab-g980h-dashcams.
In the app the same report carries its extracted indicators, its detections with Splunk SPL and Microsoft KQL already written, live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup