CISA said a dashcam platform's cloud storage was world-readable, with no fix planned
A US federal advisory published September 29 found the Viidure dashcam platform's shared cloud bucket publicly readable and its Android app carrying permanent plaintext credentials to the same storage.
The US Cybersecurity and Infrastructure Security Agency published advisory ICSA-26-272-07 on September 29, covering two vulnerabilities in the Viidure Dashcam Android Application at versions 3.3.1.260403 and earlier. CISA filed the advisory under the Transportation Systems sector, recorded the equipment as deployed worldwide and the vendor as headquartered in China.
The first, CVE-2026-94204, concerns the central cloud storage backend for the platform, which CISA described as misconfigured with public-read permissions. Because that bucket is shared storage for the whole platform, the advisory said, user records, live dashcam footage, application packages and firmware files are reachable by anyone on the internet. It carries a CVSS v3.1 base score of 7.5.
The second, CVE-2026-96587, is more severe and scored 10.0, the maximum. CISA said the Android application embeds permanent, plaintext cloud storage credentials in its compiled code, and that those credentials allow reading, modifying or deleting operational files including firmware and application binaries.
Both entries carry the same remediation text: no fix is planned, and CISA recorded that Viidure did not respond to its coordination attempts. Users were advised to contact the vendor’s customer support. The vulnerabilities were reported to CISA by Bugrahan Karahan.
It was the second advisory on vehicle camera equipment inside a week. On September 24, CISA published ICSA-26-267-01 against the Botslab G980H dashcam series, listing more than a dozen vulnerabilities across two firmware series, among them a hard-coded cryptographic key and an authentication bypass by capture-replay.
Source: CISA advisory ICSA-26-272-07