CVE-2026-82566 Details
Description
The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing client while previously established session state remains active until a separate expiration mechanism invalidates it. An unauthenticated attacker with adjacent network access could potentially take advantage of this residual authentication state to access functionality associated with another client's session.
A session management vulnerability has been identified in the Botslab G980H dash camera firmware. This vulnerability allows authentication states to remain valid even after the associated client connection has been terminated or replaced. Under certain connection conditions, a new connection can displace an existing client while keeping the previous session active until a separate expiration mechanism invalidates it. An unauthenticated attacker with adjacent network access could exploit this residual authentication state to access functionalities associated with another client's session.
Botslab has not responded to requests to work with CISA to mitigate this vulnerability. Users of affected versions of G980H Dashcams are invited to reach out to Botslab for more information.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json | [email protected] | AdvisoryBundleRemedy |
| https://www.botslab.com/pages/about-botslab | [email protected] | Vendor |
| https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01 | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Botslab G980H | G980H dash cam series 30010_QHG980HN5294SysFW+ G980H dash cam series 58_QHG980HMCN5291SysFW+ |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |
| Sep 24, 2026 | CVE Modified | CISA-ADP |