CVE-2026-87118

Executive Summary

CVE-2026-87118 is an out-of-bounds write vulnerability (CWE-787) in the command processing functionality of Botslab G980H dash camera firmware. An authenticated attacker with adjacent network access can submit specially crafted command data that corrupts process memory, potentially disrupting authentication state or crashing the affected process, causing a device restart and temporary denial of service. With a CVSS base score of 5.7, the vulnerability requires low privileges and adjacent network positioning, and primarily impacts availability rather than confidentiality or integrity.

Technical Analysis

The vulnerability resides in the firmware's command processing subsystem, which handles inbound command data. According to the NVD description, the flaw is a classic out-of-bounds write: crafted command data is not properly bounded before being written into a memory buffer allocated by the command handler, allowing data to be written beyond the intended buffer boundary. This is consistent with CWE-787 (Out-of-bounds Write), the weakness family that encompasses both stack-based and heap-based buffer overflows.

The attack surface is the device's command-processing interface, reachable by an attacker who (a) possesses valid credentials to authenticate to the device and (b) is positioned on the same adjacent network (e.g., the same Wi-Fi network, LAN segment, or Bluetooth/Wi-Fi Direct range). The CVSS vector — AV:A (Adjacent), AC:L (Low), PR:L (Low), UI:N (None), S:U (Unchanged), C:N/I:N/A:H (High Availability impact only) — confirms that no user interaction is required, the attacker must already be authenticated, and the exploitation scope remains within the vulnerable component.

Because the write lands outside the intended buffer, the practical effect described by the vendor is memory corruption that can:

• Disrupt the process's authentication state, potentially leaving the device in an inconsistent or unprotected condition, and/or
• Cause the affected command-processing process to terminate, triggering a device restart.

No specific function names, buffer sizes, command opcodes, or parameter names are disclosed in the available NVD description. The description does not state whether the overflow is stack- or heap-based, nor does it identify the precise input field that is unbounded. Analysts should treat the mechanism as a generic bounds-checking failure in command parsing and avoid assuming implementation details not present in the source data.

The lack of a CVE description from the CNA (the CNA Title is empty) means the only authoritative technical source is the NVD description text. No CWE-787 sub-classification, no affected version list, and no vendor advisory are available.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-87118. The attack chain below is inferred strictly from the vulnerability class (out-of-bounds write in command processing) and the CVSS parameters; no specific command identifiers, endpoints, or parameter names are fabricated.

1. Reconnaissance / target identification. The attacker must be on the same adjacent network as the Botslab G980H dash camera and hold valid credentials (PR:L). The attacker enumerates the device (e.g., by identifying it on the local network via its management/companion interface) and establishes an authenticated session. No public scanning signature specific to this CVE exists; generic product-based discovery (see Shodan dorks) would be the reconnaissance approach.

2. Triggering the flaw class. Once authenticated, the attacker sends command data through the device's command-processing functionality. The crafted payload is designed to exceed the bounds of the buffer that the command handler writes into. The vulnerability-class trigger is therefore a malicious command message containing an over-long or malformed field, exploiting the absence of a length/bounds check before the write.

3. Payload / execution method. At the vulnerability-class level, the attacker delivers a crafted command whose data field overflows the destination buffer. Because the CVSS scope is Unchanged and only Availability is impacted (A:H), the described outcome is memory corruption rather than reliable code execution — though memory corruption can in principle be leveraged further, the CVE as described only guarantees availability impact.

4. Post-exploitation impact. The corrupted memory either destabilizes the authentication state or causes the command-processing process to crash. A crash triggers a device restart, producing a temporary denial of service. The description does not indicate persistence, lateral movement, or exfiltration capability.

Attackers with adjacent network access and valid credentials — for example, a malicious insider on the same corporate Wi-Fi, a guest-network occupant, or an attacker who has already obtained device credentials — are the realistic threat actors.

Impact Assessment

The CVSS 3.1 base score is 5.7 (Medium). Subscore breakdown from the provided vector:

• Attack Vector (AV:A — Adjacent): the attacker must be on an adjacent network, not remotely over the internet.
• Attack Complexity (AC:L — Low): no special conditions or race conditions are required.
• Privileges Required (PR:L — Low): valid credentials are needed.
• User Interaction (UI:N — None): no victim action required.
• Scope (S:U — Unchanged): impact is confined to the vulnerable component.
• Confidentiality (C:N): no confidentiality impact described.
• Integrity (I:N): no integrity impact described, despite the "authentication state" language — the described outcome is disruption, not demonstrated modification.
• Availability (A:H — High): the primary impact; device restart causes a temporary denial of service.

Business impact is moderate: a dash camera that repeatedly restarts loses recording continuity, which matters for evidence capture, fleet safety monitoring, and compliance recording. If authentication state is disrupted, there is a theoretical window of reduced access control, but the CVE does not describe an authentication bypass, so this should not be overstated. Blast radius is limited to individually affected G980H units on the adjacent network; there is no evidence of wormable or fleet-wide propagation.

Detection Guidance

Sigma Rule

title: Botslab G980H Command Processing Out-of-Bounds Write Attempt
id: 9f3c2a71-8711-4c9e-b6d2-0e5a87118cve
status: experimental
description: Detects crafted command data submissions targeting the Botslab G980H dash camera command processing functionality (CVE-2026-87118)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87118
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: firewall
detection:
  selection_dst:
    dst_port:
      - 80
      - 443
      - 8080
  selection_oversized:
    # Oversized command payloads to the dash camera management interface
    payload_size: '> 4096'
  condition: selection_dst and selection_oversized
falsepositives:
  - Legitimate large firmware uploads
level: medium

YARA Rule

rule CVE_2026_87118_Botslab_G980H_OOB_Write
{
    meta:
        description = "Detects crafted command data targeting Botslab G980H command processing OOB write (CVE-2026-87118)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87118"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $model = "G980H" ascii nocase
        $vendor = "Botslab" ascii nocase
        $cmd = "command" ascii nocase

    condition:
        uint16(0) == 0x5A4D or
        (any of ($model, $vendor) and $cmd) or
        (filesize > 0 and $cmd and $model)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-87118 Botslab G980H Command Processing Out-of-Bounds Write Attempt"; flow:established,to_server; content:"G980H"; nocase; http_header; content:"command"; nocase; http_uri; pcre:"/.{4096,}/s"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-87118; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87118; sid:202687118; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where destination.port in (80, 443, 8080) and network.bytes > 4096 ]
  [ network where destination.port in (80, 443, 8080) and event.action == "connection_reset" ]

Splunk SPL Query

index=network sourcetype=firewall
| search (dest_port=80 OR dest_port=443 OR dest_port=8080)
| eval payload_bytes=coalesce(bytes_out, bytes)
| where payload_bytes > 4096
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port
| where count >= 5
| sort - count

Wazuh OSSEC Rule

<group name="botslab,dashcam,cve-2026-87118,">
  <rule id="2026871" level="8">
    <decoded_as>json</decoded_as>
    <field name="dest_port">80|443|8080</field>
    <field name="payload_size">\.{0,}</field>
    <description>CVE-2026-87118: Possible Botslab G980H command processing out-of-bounds write attempt (oversized command payload)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Isolate dash cameras on a dedicated VLAN/SSID with strict segmentation from corporate and guest networks, blocking adjacent-network access by untrusted parties.
   • Restrict management/command interfaces to authorized hosts via firewall ACLs; disable remote management where not required.
   • Rotate device credentials and enforce strong, unique passwords to reduce the value of the low-privilege authentication requirement.
   • Monitor for abnormal device restarts and repeated oversized command submissions (see Detection Guidance).

2. Patch/upgrade steps:

   • No vendor patch or fixed firmware version is available. Monitor the Botslab support/download page and the NVD entry for a fixed release. When a fix is published, verify the firmware checksum/signature before applying and re-test device behavior.

3. Long-term hardening:

   • Maintain an inventory of IoT/dash-camera assets and enforce network segmentation for all embedded devices.
   • Adopt a firmware update process and subscribe to vendor and NVD notifications; track EPSS as it becomes available (currently not scored).
   • Apply least-privilege credential management for device accounts and integrate device telemetry into the SOC.

References

• NVD — CVE-2026-87118: https://nvd.nist.gov/vuln/detail/CVE-2026-87118
• CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• Botslab official product/support site (vendor advisory pending): https://www.botslab.com
• FIRST EPSS (score not yet published for this CVE): https://www.first.org/epss
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

No public proof-of-concept, exploit-in-the-wild evidence, or named threat actor campaign has been observed for CVE-2026-87118. CISA KEV status: NO.