Threats affecting pkg:github/cisagov/CSAF

The Botslab G980H dash camera firmware has an authentication vulnerability in its root account accessible via the UART interface. This interface does not require a password for root access and reveals the device's WiFi password during startup. An attacker with physical access to the device can exploit this to gain root privileges and recover the WiFi password.

CVE-2026-8108 is a high-severity vulnerability in Fuji Electric Tellus version 5.0.2 where the installation adds a kernel driver that grants all users read and write permissions. This misconfiguration can lead to unauthorized access and modification of kernel-level resources.

CVE-2026-25775 is a critical vulnerability in the SenseLive X3050 device's remote management service. It allows unauthenticated and unauthorized firmware retrieval and update operations. The service does not verify user privileges, the integrity of uploaded firmware images, or the authenticity of the firmware, exposing the device to potential malicious firmware manipulation. This vulnerability affects version V1.523 of the product. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.

CVE-2026-35064 is a high-severity vulnerability in the SenseLive X3050 management ecosystem that allows unauthenticated attackers on the same network segment to discover deployed devices. The vulnerability arises because the device discovery function is exposed without requiring authentication, enabling attackers to identify device presence, identifiers, and management interfaces. This lack of authentication for a critical function can facilitate rapid enumeration of targeted devices by unauthorized parties.

CVE-2026-40620 is a critical vulnerability in the SenseLive X3050 device's embedded management service that allows an attacker to gain full administrative control without any authentication or authorization. The vulnerable service accepts management connections from any reachable host, enabling unrestricted modification of critical configuration parameters, operational modes, and device state. This lack of authentication exposes the device to complete compromise by unauthorized parties.

CVE-2026-27843 is a critical vulnerability in the SenseLive X3050 device's web management interface that allows modification of critical configuration parameters without proper authentication or server-side validation. Exploitation can cause a persistent lockout state by applying unsupported or disruptive values to recovery and network settings. The device lacks a physical reset button, so recovery requires specialized console access to perform a factory reset, resulting in a total denial-of-service for the gateway and connected RS-485 systems.