The Botslab G980H dash camera firmware contains a CWE-22 path traversal vulnerability in its HTTP server component. This flaw allows an attacker with network access to the device's WiFi to submit specially crafted HTTP requests that bypass intended directory restrictions. As a result, unauthorized access to files stored on the device's removable storage is possible, exposing potentially sensitive data such as video recordings, images, diagnostic logs, and firmware files. The vulnerability is identified as CVE-2026-82708 with a CVSS 4.0 base score of 7.1 (high severity).

Successful exploitation enables an attacker on the local WiFi network to access sensitive files stored on the device's removable storage that are not meant to be publicly accessible. This could lead to exposure of private recordings, images, logs, or firmware, potentially compromising user privacy and device integrity. There is no indication of remote exploitation without network access or privilege escalation.

No official patch or remediation has been provided yet for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's WiFi network to trusted users only and monitor for suspicious activity on the local network.