Security 1 publisher2 min readPublished September 24, 2026 at 12:49 PM PDT

Botslab G980H dashcam firmware grants privileged commands to any holder of a guessable session ID

CISA lists 14 CVEs in two Botslab G980H dashcam firmware lines, including session flaws that can give an attacker on the camera's network privileged access. Botslab has not answered CISA, so operators have no fix date to plan around.

The Watch · Security desk

Illustration accompanying Botslab G980H dashcam firmware grants privileged commands to any holder of a guessable session ID

What happened

CISA's advisory lists 13 CVEs against each of two Botslab G980H dashcam firmware lines, 14 distinct identifiers across both.
CISA says successful exploitation could let an attacker bypass authentication, reach sensitive data and privileged functions, change configuration and disrupt the camera.
CISA places the cameras in the transportation systems sector, deployed worldwide, from a vendor headquartered in China.
Botslab has not responded to CISA's requests to work on mitigation, and the advisory's only remediation is to contact the company.

Compiled by The WatchSomething wrong?How this is made

Why it matters

capability An attacker who gets onto a camera's network needs no stolen password, only a live session to target and a guessable identifier to reach privileged commands.
constraint With Botslab not engaging CISA, an operator's plan to isolate or replace these cameras cannot be scheduled against a firmware release.
exposure Exposure is limited to attackers who can reach each camera's local network, so control over who joins that network is the one control operators hold today.

The two firmware lines share 12 of their CVEs ^[4]. CVE-2026-79959 is listed only against 30010_QHG980HN5294SysFW+, and CVE-2026-88956 only against 58_QHG980HMCN5291SysFW+ ^[2]. Matching asset records to this advisory takes the firmware string as well as the model name ^[2].

Four of the flaws are in session handling, and they combine. The firmware does not tie an authenticated session to the client connection that set it up. Privileged operations check only that the requester holds a valid session identifier (CWE-863) ^[5]. Those identifiers come from a small sequential value space (CWE-340) ^[7]. According to CISA, an attacker with adjacent network access who knows a session is active could work out a valid identifier and use it to bypass authorization ^[7].

Sessions also outlive their connections. A new connection can displace the original client while the old session state stays valid until a separate expiry mechanism clears it (CWE-613) ^[6]. The identifier keeps working after its owner has been pushed off ^[6].

The fourth flaw is a second way in. The firmware accepts a reusable authentication value without checking its freshness or which client sent it. An attacker who captures one can replay it from another client to open an authenticated session ^[8]. Guessing needs only the knowledge that a session exists. Replay needs a captured value ^[7]^[8].

Adjacency sets the exploitability. CISA describes all four as usable by an unauthenticated attacker with adjacent network access ^[5]^[6]^[7]^[8]. As described, none of them works for an attacker who cannot first get onto the camera's local network. Once there, the attacker needs no credentials of their own ^[5]^[7].

What to watch

Any response from Botslab to CISA, or new firmware for the 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+ lines.
A CISA revision of the advisory that adds a fixed version or reports exploitation.
Public proof-of-concept code for the sequential session-ID or replay flaws.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data and privileged device functionality, modify device configuration, disrupt device operation.
ReportedSupportedSource: CISA advisory, Botslab G980H Dashcams, summaryView cited source
[2]
Two G980H dash cam firmware lines are affected: 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+. Each has 13 CVEs listed. CVE-2026-79959 appears only in the 30010_QHG980HN5294SysFW+ list and CVE-2026-88956 appears only in the 58_QHG980HMCN5291SysFW+ list; the other 12 appear in both.
ReportedSupportedSource: CISA advisory, affected versionsView cited source
[3]
Critical infrastructure sector: Transportation Systems. Countries/areas deployed: Worldwide. Company headquarters location: China.
ReportedSupportedSource: CISA advisory, backgroundView cited source
[5]
The firmware does not sufficiently associate an authenticated session with the client connection that established it; subsequent privileged operations rely on possession of a valid session identifier without adequately validating the requesting client's authenticated context. An unauthenticated attacker with adjacent network access could potentially use valid session state associated with another client to access privileged functionality. Relevant CWE: CWE-863 Incorrect Authorization.
ReportedSupportedSource: CISA advisory, vulnerability descriptionView cited source
[6]
Authentication state can remain valid after the associated client connection has been terminated or replaced; a newly established connection can displace an existing client while previously established session state remains active until a separate expiration mechanism invalidates it. An unauthenticated attacker with adjacent network access could potentially use this residual state to access functionality associated with another client's session. Relevant CWE: CWE-613 Insufficient Session Expiration.
ReportedSupportedSource: CISA advisory, vulnerability descriptionView cited source
[7]
The firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could potentially determine a valid session identifier and use it to bypass intended authorization controls. Relevant CWE: CWE-340 Generation of Predictable Numbers or Identifiers.
ReportedSupportedSource: CISA advisory, vulnerability descriptionView cited source
[8]
The firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another client to establish an authenticated session and access privileged device functionality.
ReportedSupportedSource: CISA advisory, vulnerability descriptionView cited source
[9]
Botslab has not responded to requests to work with CISA to mitigate this vulnerability. Users of affected versions of G980H Dashcams are invited to reach out to Botslab for more information. The mitigation section lists no patched firmware version.
ReportedSupportedSource: CISA advisory, remediationsView cited source
[4]
The two firmware lines share 12 CVEs, giving 14 distinct CVEs across both lines.
DerivedSupported1 source— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

cisa.gov
1 article · September 24, 2026
Botslab G980H Dashcams

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

CISA describes four session flaws that compound. Session IDs come from a small sequential range. The firmware does not bind a session to the connection that opened it, a displaced client's session stays live until a separate timer clears it, and a captured authentication value can be replayed from a different client. Together, anyone who can reach the camera's network and knows a session is active could guess a working ID and use privileged functions. The same advisory lists a default WiFi password derived from device information the camera partly advertises, and a root account on the UART interface that asks for no password. Each finding comes with its CWE, so for anyone designing a session-based command interface on embedded hardware, the advisory is a list of specific design errors.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence60

0100

One detailed government source

Every technical claim comes from one CISA advisory, and it is specific: each flaw has a CWE, an attack precondition and the firmware lines it affects. Corroboration is the weak point. Botslab has not engaged with CISA, no researcher write-up accompanies the advisory, and the scoring sections in our copy show no CVSS values.

AdoptionInsufficient

Deployment not sized

CISA says the cameras are deployed worldwide in the transportation sector. It gives no unit count, market share or named fleet customer, so the number of exposed devices cannot be estimated.

Hype gap+8

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

security
CERT Polska rebuilt MikroTik's silent RouterOS patch into a working exploit within days
1 publisher
security
CVE-2026-67367 lets an unauthenticated request read private keys off SIMOVE Fleetmanager hosts
1 publisher
security
Siemens ships four builds to close a root-level file upload in Siveillance Control's OIS module
1 publisher
security
Unauthenticated attackers can reset any Industrial Edge Management password without the email link
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources