SecBoard
Zurück zur CVE-Übersicht

CVE-2026-82585

MEDIUM(6.5)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Risk Signal Score26/100 — MITTEL
  • CVSS 6.5 — Mittel
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

6.5

Technische Schwere

Beschreibung

The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device's WiFi network could obtain stored recordings, live video, location information, images, diagnostic logs, or other sensitive information exchanged between the device and its mobile application.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

This vulnerability involves the cleartext transmission of sensitive information over unencrypted HTTP and RTSP connections. Detection should focus on network traffic analysis for unencrypted communication from Botslab G980H devices.

Sentinel/Defender KQL

let BotslabG980H_IPs = dynamic(['<IP_ADDRESS_OF_BOTSLAB_G980H_DEVICE>']);
NetworkCommunicationEvents
| where DestinationIP in (BotslabG980H_IPs) or SourceIP in (BotslabG980H_IPs)
| where DestinationPort == 80 or DestinationPort == 554 // HTTP and RTSP default ports
| where Protocol == "tcp"
| summarize count() by bin(5m), SourceIP, DestinationIP, DestinationPort, Protocol
| where count_ > 0

Splunk SPL

index=* (src_ip="<IP_ADDRESS_OF_BOTSLAB_G980H_DEVICE>" OR dest_ip="<IP_ADDRESS_OF_BOTSLAB_G980H_DEVICE>") (dest_port=80 OR dest_port=554) | stats count by src_ip, dest_ip, dest_port, protocol

Sigma

title: Botslab G980H Cleartext Communication
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects unencrypted HTTP and RTSP communication from Botslab G980H dash cameras, indicating potential sensitive information disclosure.
author: SecBoard
date: 2026/09/24
logsource:
  category: network_connection
  product: firewall
  service: network
detection:
  selection:
    dvc_ip|contains: '<IP_ADDRESS_OF_BOTSLAB_G980H_DEVICE>'
    dest_port:
      - 80
      - 554
    protocol: tcp
  condition: selection
level: medium

Elastic ES|QL

from network.flow
| where (source.ip == "<IP_ADDRESS_OF_BOTSLAB_G980H_DEVICE>" or destination.ip == "<IP_ADDRESS_OF_BOTSLAB_G980H_DEVICE>")
| where (destination.port == 80 or destination.port == 554)
| where network.transport == "tcp"
| summarize flow_count = count() by source.ip, destination.ip, destination.port, network.transport

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen