CVE-2026-75558 Botslab G980H Dashcams Use of Hard-coded Cryptographic Key
Attackers can extract hard-coded keys from Botslab G980H dashcam firmware to decrypt WiFi credentials and access the device network.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-75558?
CVE-2026-75558 is a medium-severity vulnerability in Botslab G980H, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password and gain unauthorized access to the device network.
Weakness: CWE-321
Which versions are affected by CVE-2026-75558?
How do I fix CVE-2026-75558?
No fix has been published for CVE-2026-75558 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-75558 being exploited?
There is no known exploitation of CVE-2026-75558 in the wild and no public exploit code.
Sources
Also known as GHSA-26fw-w27q-phjj.