CVE-2026-96587: Use of Hard-coded Credentials in Viidure Dashcam Android Application
The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the exposed cloud storage credentials?
An unauthenticated remote attacker could use the embedded plaintext credentials. No privileges or user interaction are required.
What could an attacker do with the affected cloud storage?
The credentials provide full access to critical platform storage. An attacker could read, modify, or delete operational files, including firmware and application binaries.
How can an organization determine whether it is exposed?
Organizations using the Viidure Android application should treat the application as exposed because the credentials are embedded in its compiled code. The available information does not identify affected version ranges or a fixed release.