CVE-2026-82708CWE-22path-traversal

CVE-2026-82708

Medium · published September 25, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
11.1
In the wild
Unconfirmed
What it is

The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with access to the device's WiFi network could submit a crafted request to access files within the device's removable storage that were not intended to be directly accessible through the web server. Exposed files could include recordings, images, diagnostic logs, or firmware files.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00214 · 11.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-25T01:18Z
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json · [email protected]https://www.botslab.com/pages/about-botslab · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01 · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 20:21Z
    Botslab G980H Dashcams Improper Limitation of a Pathname to a Restricted Directory
    cvelistv5