Botslab G980H Dashcams Ship With 13 Unpatched Flaws and the Vendor Has Gone Quiet

Key points

• CISA published an advisory covering 13 vulnerabilities in Botslab's G980H dashcam series, and the Chinese vendor has not responded to CISA's coordination requests.
• The worst bugs carry a CVSS severity score of 8.8 out of 10, high enough that CISA flags them as a risk to the Transportation Systems sector.
• Flaws include a hard-coded password baked into the firmware, a root shell exposed on the device's hardware debug port with no password required, and default WiFi passwords derivable from information the camera itself broadcasts.
• An attacker within WiFi range could hijack another user's session, pull footage, or knock the camera offline.
• No patched firmware exists. CISA points users to Botslab's website for information the company has not provided.

The U.S. Cybersecurity and Infrastructure Security Agency has flagged 13 security flaws in Botslab's G980H dashboard cameras, sold worldwide by the Shenzhen-based firm. Published through CISA's industrial control systems channel, the advisory is unusual for a single reason: the vendor has gone silent.

"Botslab has not responded to requests to work with CISA to mitigate this vulnerability," the agency writes. That line appears under all 13 CVE entries. No patch. No firmware update. Nothing from the people who wrote the code.

What is actually broken?

Almost every lock on the device is faulty. The bugs cluster around authentication (proving who you are to the camera) and session management (keeping that proof valid only for you, only for as long as it should last).

CVE-2026-84399, rated 8.8, lets an attacker on the same local network reuse another user's active session to run privileged commands. CVE-2026-82566 keeps a session alive after the real user disconnects, so someone else can slide into it. CVE-2026-85496 hands out session IDs from a small, sequential pool, meaning an attacker can guess them.

CVE-2026-77967 lets an attacker who captures one valid login token replay it from a different machine. CVE-2026-88761 covers the default WiFi password, which is generated from device details the camera broadcasts, so an attacker nearby only needs to guess the remaining characters.

CVE-2026-88956 is the one that stings. The root account, the top-level administrator account on the underlying Linux system, sits exposed through the camera's UART port (a hardware debug interface on the circuit board) with no password required. Anyone who cracks the case open owns the device.

This pattern, layered authentication failures with a passwordless hardware backdoor underneath, is precisely what we flagged in the Skullcandy Dime 3 earbuds story on 17 September: a consumer device where the vendor controls the only fix and has chosen not to ship one.

Which cameras are affected?

CISA names two firmware trains: 30010_QHG980HN5294SysFW+ and 58_QHG980HMCN5291SysFW+. Both are current shipping firmware for the G980H series.

Who should care?

If you own one of these cameras, the practical risk is someone within WiFi range of your parked vehicle, a car park, a depot, a rest stop, pulling video off the device or blinding it. For a fleet operator running dozens of vans on the same model, that risk multiplies. Adjacent network access sounds technical; for a device parked in public, it's not much of a barrier.

What can owners do right now?

Not a lot. With no patch available, the sensible steps are the boring ones: change the default WiFi password to something long and random, disable the camera's WiFi when you're not actively pulling footage, and avoid pairing it on untrusted networks.

My read: the CVE count matters less than the vendor silence. Thirteen bugs in one product is bad. A vendor who won't answer CISA is worse, because it tells you nothing else is coming. If your fleet standardised on the G980H, start pricing a replacement.