CVE-2026-82708

Executive Summary

CVE-2026-82708 is a path traversal vulnerability (CWE-22) affecting the HTTP server embedded in Botslab G980H dash camera firmware. An attacker who can reach the device's Wi-Fi network can submit a crafted HTTP request to read files stored on the device's removable storage that the web server was not intended to expose, including recordings, images, diagnostic logs, and firmware files. With a CVSS v3.1 base score of 6.5 (Medium) and no vendor patch, no public PoC, and no CISA KEV listing, this represents an unpatched confidentiality-only exposure that primarily threatens physical-proximity or co-located-network attackers.

Technical Analysis

The vulnerability resides in the web server component of the G980H dash camera firmware. Path traversal (CWE-22) occurs when an application constructs a filesystem path from user-supplied input without adequately neutralizing directory traversal sequences (for example, ../ or encoded equivalents). In this case, the affected web server fails to properly constrain file access to an intended directory, allowing a crafted request to resolve to locations on the device's removable storage that should not be directly reachable through the HTTP interface.

Key characteristics derived strictly from the available description:

• Attack surface: The device's embedded HTTP server, reachable over the device's Wi-Fi network.
• Vulnerability class: Path traversal / directory traversal (CWE-22). The precise endpoint, parameter, and input-handling routine are not specified in the NVD description or CNA title; therefore, the exact request structure cannot be stated authoritatively. The weakness class implies that a request parameter or path segment is used to build a file reference without normalization or allow-list validation of the resolved path.
• Impacted data: Files on removable storage that the web server was not intended to serve. The description explicitly names recordings, images, diagnostic logs, and firmware files as potentially exposed categories.

Because no implementation detail (endpoint path, parameter name, or code function) is provided in the source data, no specific URL paths or parameter names are asserted here. The analysis is bounded at the vulnerability-class level. No public PoC, Nuclei template, or exploit code is available for this CVE.

The CVSS vector AV:A (Adjacent Network) confirms the access model: the attacker must be on the same network segment (here, the device Wi-Fi network) rather than remote over the internet. AC:L and PR:N/UI:N indicate the traversal is straightforward to trigger with no authentication or user interaction required. C:H / I:N / A:N scopes the impact to high confidentiality loss with no integrity or availability effect.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker joins or has access to the same Wi-Fi network as the Botslab G980H. The device's embedded HTTP server is identified on the local network (standard local service enumeration). No credentials or user interaction are required per the CVSS vector.

2. Triggering the flaw class. The attacker crafts an HTTP request whose path or parameter includes directory traversal sequences (../ or an encoded variant such as %2e%2e%2f). Because the server does not properly normalize or restrict the resolved path, the request escapes the intended web-served directory and resolves to a location on the removable storage. The exact endpoint and parameter are not disclosed in the source data.

3. Payload / execution method. At the vulnerability-class level, the payload is a malicious path string embedded in the request. Success returns the contents of the targeted file in the HTTP response. No code execution is involved — this is a file-disclosure primitive only.

4. Post-exploitation impact. The attacker reads files not intended to be web-accessible. Per the NVD description these may include recordings, images, diagnostic logs, and firmware files. Exfiltrated diagnostic logs and firmware files can aid further analysis of the device (e.g., identifying additional weaknesses), while recordings and images represent a privacy breach. There is no integrity or availability impact.

Impact Assessment

• Confidentiality: High (C:H). Arbitrary read of files on removable storage not intended to be web-accessible, including recordings, images, diagnostic logs, and firmware files.
• Integrity: None (I:N). The vulnerability does not modify files or device state.
• Availability: None (A:N). No denial-of-service component.
• Scope: Unchanged (S:U). Impact is confined to the vulnerable device.
• Attack vector: Adjacent Network (AV:A). Exploitation requires network access to the device's Wi-Fi. Low complexity, no privileges, no user interaction.

Blast radius. Limited to devices reachable on the same network segment. In vehicle, home, or fleet deployments, the dash camera's Wi-Fi may be exposed to passengers, co-located devices, or — if misconfigured — to a broader network. The confidentiality impact is significant where recordings, images, and diagnostic logs contain personal, location, or operational data; exposed firmware files also increase the information available to an attacker for follow-on research. Business impact is primarily privacy and data-protection related rather than operational.

Detection Guidance

Sigma Rule

title: Path Traversal Attempt Against Botslab G980H Dash Camera HTTP Server
id: 3f2b9c14-8270-4d5e-9a11-cve202682708
status: experimental
description: Detects directory traversal sequences in HTTP requests targeting the Botslab G980H embedded web server, indicating CWE-22 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82708
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..%5c'
      - '%252e%252e%252f'
  condition: selection_method and selection_traversal
falsepositives:
  - Legitimate administrative access using relative paths
level: medium
tags:
  - attack.t1190
  - cve.2026.82708

YARA Rule

rule CVE_2026_82708_Botslab_G980H_PathTraversal
{
    meta:
        description = "Detects path traversal sequences indicative of CVE-2026-82708 exploitation against Botslab G980H HTTP server request artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82708"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $trav1 = "../" ascii
        $trav2 = "..\\" ascii
        $enc1  = "%2e%2e%2f" ascii nocase
        $enc2  = "..%2f" ascii nocase
        $enc3  = "%2e%2e/" ascii nocase
        $enc4  = "%252e%252e%252f" ascii nocase
        $http  = "HTTP/1." ascii

    condition:
        $http and any of ($trav*) or any of ($enc*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82708 Botslab G980H Dash Camera Path Traversal Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(\.\.(\/|\\|%2f|%5c))|(%2e%2e(%2f|\/))|(%252e%252e%252f)/i"; reference:cve,2026-82708; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-82708; classtype:attempted-recon; sid:202682708; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method in ("GET", "POST") and
     wildcard(http.request.uri, "*../*") ]
  [network where http.request.method in ("GET", "POST") and
     wildcard(http.request.uri, "*%2e%2e%2f*") ]

Splunk SPL Query

index=web OR index=proxy
| search (method=GET OR method=POST)
| where match(uri, "(?i)(\.\.(%2f|%5c|/|\\|%252e%252e%252f))|(%2e%2e(%2f|/))")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as attempted_uris by src_ip, dest_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="webaccesslog,cve-2026-82708,">
  <rule id="202682708" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <regex type="pcre2">(?i)(\.\.(%2f|%5c|/|\\|%252e%252e%252f))|(%2e%2e(%2f|/))</regex>
    <description>CVE-2026-82708: Botslab G980H dash camera path traversal attempt detected in HTTP request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,attempted_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was identified from any tracked source; no affected-version range or vendor fix is published.

1. Immediate mitigations (compensating controls):

• Restrict the dash camera's Wi-Fi exposure. Disable the device Wi-Fi hotspot when not required and avoid placing the device on shared or untrusted networks.
• Where feasible, segment device Wi-Fi from any production, corporate, or shared network; treat the camera's network as untrusted.
• Apply local-network access controls so only intended clients can reach the device's HTTP server.
• Reduce the sensitivity of data on removable storage (e.g., shorten recording retention, limit storage of diagnostic logs) to shrink what traversal could expose.
• Monitor web/proxy logs for traversal sequences as defined in the detection rules above.

2. Patch/upgrade steps:

• No vendor patch, advisory, or fixed version is currently available. Monitor the vendor (Botslab) for a firmware security update and the NVD entry for the CVE. Until a fix is published, rely on compensating controls above.
• When a firmware update becomes available, validate the fix version against the CVE record before applying, and re-test the web server after upgrade.

3. Long-term hardening:

• Require vendors to implement strict path canonicalization and allow-list validation for any file-serving logic in embedded web servers.
• Adopt network segmentation and zero-trust assumptions for IoT/embedded devices; never treat device Wi-Fi as a trusted enclave.
• Include embedded devices in vulnerability management and firmware-update tracking programs, with alerting on unpatched CVEs such as this one.

References

• NVD — CVE-2026-82708: https://nvd.nist.gov/vuln/detail/CVE-2026-82708
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (N/A — this CVE is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Botslab G980H product/vendor resources: vendor firmware support page (no security advisory published at time of writing)

No threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-82708. EPSS score is not yet assigned by FIRST.org. No public PoC, exploit code, or Nuclei template is available.