CVE-2026-84403CWE-306

CVE-2026-84403

Medium · published September 25, 2026

CVSS v3.1
6.2
EPSS
0%
Percentile
1.8
In the wild
Unconfirmed
What it is

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device information, including device identifiers, firmware information, and protected WiFi credentials.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00122 · 1.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-25T01:18Z
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json · [email protected]https://www.botslab.com/pages/about-botslab · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01 · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 20:07Z
    Botslab G980H Dashcams Missing Authentication for Critical Function
    cvelistv5