CVE-2026-79959CWE-798hardcoded-credentials

CVE-2026-79959

Medium · published September 25, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
6.5
In the wild
Unconfirmed
What it is

The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or has physical access to the device could recover the credential and use it to obtain root access through the UART interface.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.0 · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00174 · 6.5th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-09-25T01:18Z
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json · [email protected]https://www.botslab.com/pages/about-botslab · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01 · [email protected]
EPSS history
Timeline
  • 26 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 24 SEP 20:25Z
    Botslab G980H Dashcams Use of Hard-coded Credentials
    cvelistv5