CVE-2026-88956: Botslab G980H Dashcams Missing Authentication for Critical Function
The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's WiFi password during startup. An unauthenticated attacker with physical access to the device could connect to the UART interface, obtain root privileges, and recover the WiFi password.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Devices are exposed to someone who can physically access the dashcam and connect to its UART interface. The issue does not describe a remote-only attack path.
What does an attacker need to exploit it?
An attacker needs physical access to the device and access to the UART interface. No password is required for the affected root account.
What could an attacker obtain after exploiting the issue?
The attacker could gain root-level access to the device's privileged system interface. They could also recover the device WiFi password, which is displayed during startup.
How can I determine whether a device is affected?
The provided information identifies Botslab G980H dashcams as affected. It does not provide firmware versions or a configuration check to distinguish affected from unaffected units.