Julian

The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing client while previously established session state remains active until a separate expiration mechanism invalidates it. An unauthenticated attacker with adjacent network access could potentially take advantage of this residual authentication state to access functionality associated with another client's session.

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession of a valid session identifier without adequately validating the requesting client's authenticated context. An unauthenticated attacker with adjacent network access could potentially use valid session state associated with another client to access privileged functionality.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The firmware generates session identifiers using a small sequential value space instead of an unpredictable source. An unauthenticated attacker with adjacent network access and knowledge of an active session could determine a valid session identifier to bypass authorization controls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who extracts this cryptographic material from the firmware can recover the WiFi password, potentially leading to unauthorized access to the device network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The firmware fails to properly verify the freshness or client association of authentication values. An unauthenticated attacker with adjacent network access can capture a valid authentication value and replay it to establish an authenticated session, granting access to privileged device functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprotected connection and relies on an integrity value supplied with the firmware instead of a trusted cryptographic signature. A suitably positioned attacker who intercepts a firmware download, or an authenticated attacker who submits a crafted update, could install modified firmware and execute unauthorized code on the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The HTTP server in the firmware contains a path traversal flaw. This allows an attacker connected to the device WiFi network to send a specially crafted request to access files on the removable storage that are not intended for direct web server access. Potentially exposed data includes recordings, images, diagnostic logs, and firmware files. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The firmware includes sensitive configuration information, such as WiFi credentials, within diagnostic logs created during the support process. These logs persist on removable storage after the support operation ends, allowing an unauthenticated attacker with physical access to the storage media to retrieve sensitive device information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The firmware fails to require authenticated pairing or client binding before allowing access to Bluetooth Low Energy communications and GATT characteristics. This allows an unauthenticated attacker within Bluetooth range to intercept or retrieve sensitive device information, such as device identifiers, firmware information, and protected WiFi credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The firmware contains an out of bounds write issue within its command processing functionality. An authenticated attacker with adjacent network access can submit crafted command data to corrupt memory. This may disrupt the authentication state or cause the affected process to terminate, leading to a device restart and a temporary denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are advertised by the product. An unauthenticated attacker within WiFi range could potentially determine the remaining password characters through limited guessing and gain unauthorized access to the device network.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The firmware contains an authentication flaw in the root account accessible via the UART (Universal Asynchronous Receiver-Transmitter, a hardware communication protocol) interface. This account allows access to a privileged system interface without requiring a password. Additionally, the interface reveals the device WiFi password during the startup process. An attacker with physical access to the hardware can use the UART interface to gain root privileges and retrieve the WiFi password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The firmware contains a hard-coded root account password that is immutable by the user. An attacker with physical access to the device or access to the firmware can recover these credentials to gain root access via the UART (Universal Asynchronous Receiver-Transmitter, a hardware communication protocol) interface. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Botslab G980H (affected versions not specified) **Description** The firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device WiFi network could obtain stored recordings, live video, location information, images, diagnostic logs, or other sensitive information exchanged between the device and its mobile application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.