CVE-2026-84403 in G980H
Summary
by MITRE • 09/24/2026
The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device information, including device identifiers, firmware information, and protected WiFi credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Botslab G980H dash camera presents a critical security vulnerability stemming from the absence of authentication mechanisms for its Bluetooth Low Energy interface. This design flaw allows any attacker within physical proximity to establish an unauthenticated connection with the device without requiring pairing or client binding procedures. In standard secure implementations, devices typically enforce mutual authentication before exposing sensitive services or characteristics over wireless interfaces. However, in this specific firmware version, the lack of such controls means that the Bluetooth Low Energy stack accepts connections from any nearby peer, effectively treating all incoming requests as legitimate regardless of their origin. This fundamental oversight bypasses essential access control layers that are designed to prevent unauthorized entities from interacting with device hardware and software components.
The technical consequence of this misconfiguration is severe data exposure through exposed Generic Attribute Profile characteristics. Once connected, an attacker can enumerate the available services and read specific GATT characteristics that contain highly sensitive information. These include unique device identifiers which can be used for tracking or spoofing purposes, detailed firmware version strings that aid in identifying known vulnerabilities, and most critically, protected WiFi credentials. The retrieval of these network passwords allows the attacker to gain full access to the local wireless network on which the dash camera is connected. This level of access extends beyond the immediate device, potentially compromising other devices on the same subnet or allowing for man-in-the-middle attacks against traffic traversing that network segment.
From an operational impact perspective, this vulnerability enables a range of malicious activities including surveillance tracking, credential theft, and potential remote control if further exploitation paths exist within the WiFi-connected services. The exposure of device identifiers facilitates long-term physical tracking of vehicles equipped with these cameras, raising significant privacy concerns for users. Furthermore, obtaining WiFi credentials may allow attackers to intercept video footage stored locally or streamed via cloud services if those services rely on local network authentication. This scenario aligns closely with CWE-287, which describes Improper Authentication, as the system fails to adequately verify the identity of a user before granting access to resources. Additionally, it relates to CWE-319 regarding Cleartext Transmission of Sensitive Information within the Bluetooth link layer context where encryption might be bypassed due to lack of initial authentication handshake requirements.
In terms of threat modeling and adversary behavior, this vulnerability supports techniques categorized under MITRE ATT&CK ID T1046, specifically Network Service Discovery via Bluetooth Low Energy. An attacker can use standard BLE scanning tools to discover the device and then proceed to read characteristics without needing prior authorization. This ease of exploitation makes it a high-risk issue for consumer electronics that prioritize convenience over security during initial setup or pairing processes. The lack of binding means there is no cryptographic link established between the user's smartphone app and the camera, leaving all subsequent communications vulnerable to interception by any passive observer within radio range.
To mitigate this risk, immediate firmware updates from Botslab are recommended if available, as they likely implement proper authentication protocols such as Just Works or Passkey entry during pairing. Until patches are deployed, users should consider disabling Bluetooth functionality on the device when not actively using it for configuration purposes. Network segmentation strategies can also help limit the blast radius; placing dash cameras in a separate VLAN isolated from primary workstations and sensitive data servers reduces the impact of WiFi credential theft. Furthermore, enabling strong WPA3 encryption where supported adds an additional layer of protection against offline dictionary attacks on captured handshakes if credentials are compromised. Regular security audits focusing on wireless interface configurations should be conducted to ensure that no other devices in similar deployments suffer from analogous authentication deficiencies.