What’s Vulnerable › Vulnerabilities

CVE-2026-82566: Botslab G980H Dashcams Insufficient session expiration

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-24 · updated 2026-09-24
• Weakness: CWE-613

Description

The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing client while previously established session state remains active until a separate expiration mechanism invalidates it. An unauthenticated attacker with adjacent network access could potentially take advantage of this residual authentication state to access functionality associated with another client's session.

Affected products

• Botslab G980H: 30010_QHG980HN5294SysFW+, 58_QHG980HMCN5291SysFW+

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json
• https://www.botslab.com/pages/about-botslab
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01

Get alerted when CVE-2026-82566 or the next vulnerability affects your stack