The Botslab G980H dash camera firmware uses session identifiers derived from a limited sequential value space rather than a cryptographically secure random source. An attacker on the adjacent network who knows an active session exists can potentially enumerate or predict valid session IDs, enabling unauthorized access by bypassing intended authorization mechanisms. This vulnerability is tracked as CVE-2026-85496 and is classified under CWE-340 (Insufficiently Random Values). It affects firmware versions =30010_QHG980HN5294SysFW+ and =58_QHG980HMCN5291SysFW+. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no vendor patch or advisory information is provided in the input data.

Successful exploitation allows an unauthenticated attacker with adjacent network access to bypass authorization controls by guessing valid session identifiers. This can lead to full compromise of the device's confidentiality, integrity, and availability as indicated by the CVSS vector. The attacker could potentially control or manipulate the dash camera without proper authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit network access to trusted devices only and monitor for unauthorized access attempts. Avoid exposing the device to untrusted adjacent networks.