The firmware of Botslab G980H dash cameras contains a hard‑coded root account password that users cannot alter. An attacker who can access the firmware binary or obtain the device physically could recover this password. With the recovered credential the attacker can use the UART interface to authenticate as a root user and gain full system control. The vulnerability does not involve remote network services, but it enables local privilege escalation on any compromised device.

The affected product is the Botslab G980H dash camera. No specific firmware versions are listed, so all current and future releases of this model are potentially vulnerable unless a patch is applied.

The CVSS score of 7.0 indicates a moderate to high severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires either access to the firmware file or physical access to the device to read the UART. Once the credential is discovered a local attacker can attain root, compromising confidentiality, integrity, and availability of the device and any data stored or transmitted by it.