Threats affecting pkg:github/botslab/g980h

The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. This flaw allows an attacker on the device's WiFi network to craft requests that access files on removable storage not intended for web access, such as recordings, images, logs, or firmware files. The vulnerability affects specific firmware versions and has a high severity rating.

CVE-2026-87118 is an out-of-bounds write vulnerability in the command processing functionality of Botslab G980H dash camera firmware. An authenticated attacker with adjacent network access can exploit this flaw by submitting crafted command data that corrupts memory. This corruption may disrupt the authentication state or cause the affected process to terminate and the device to restart, leading to a temporary denial of service. The vulnerability affects specific firmware versions =30010_QHG980HN5294SysFW+ and =58_QHG980HMCN5291SysFW+.

CVE-2026-77967 is a vulnerability in the Botslab G980H dash camera firmware where the device accepts a reusable authentication value without properly verifying its freshness or client association. This flaw allows an unauthenticated attacker with adjacent network access to replay a captured valid authentication token from another client, thereby establishing an authenticated session and gaining access to privileged device functions.

The Botslab G980H dash camera firmware uses predictable, small sequential values to generate session identifiers. This weakness allows an unauthenticated attacker with adjacent network access to potentially guess valid session IDs and bypass authorization controls. The vulnerability affects specific firmware versions and has a high severity rating.