CVE-2026-75558: Botslab G980H Dashcams Use of Hard-coded Cryptographic Key

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-24 · updated 2026-09-25
Weakness: CWE-321

Description

The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password and gain unauthorized access to the device network.

Affected products

Botslab G980H: 30010_QHG980HN5294SysFW+, 58_QHG980HMCN5291SysFW+

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json
https://www.botslab.com/pages/about-botslab
https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01

Get alerted when CVE-2026-75558 or the next vulnerability affects your stack