CVE-2026-94204CWE-732

CVE-2026-94204

High · published September 30, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-09-30T01:19Z
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-07.json · [email protected]https://viidure.app/ · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:50Z
    EPSS moved — → 0%
    epss
  • 29 SEP 20:40Z
    Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application
    cvelistv5