CVE-2026-96587 is a critical vulnerability in the Viidure Dashcam Android application where permanent plaintext cloud storage credentials are embedded within the application's compiled code. This use of hard-coded credentials (CWE-798) allows an attacker to gain full access to the cloud storage platform, including the ability to read, modify, or delete operational files such as firmware and application binaries. The vulnerability affects versions >=0 and <=3.3.1.260403. The CVSS 4.0 base score is 10, indicating maximum severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. There is no vendor advisory or patch information available at this time.

An attacker who extracts the hard-coded credentials can fully control the cloud storage platform associated with the Viidure Dashcam Android application. This includes the ability to read sensitive operational files, modify firmware or application binaries, or delete critical data, potentially disrupting device functionality or enabling further attacks. The vulnerability poses a critical risk to device security and operational integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should consider limiting exposure of affected versions and monitor for updates from Viidure regarding remediation. Avoid deploying affected versions in sensitive environments where possible.