The vulnerability involves a misconfigured central cloud storage bucket that is set to public‑read, permitting anyone on the internet to retrieve all stored objects. This exposes sensitive user information, live dashcam footage, application packages, and firmware files to unrestricted read access. The confidentiality of these assets is compromised, and attackers could abuse the exposed firmware for malicious modification or distribution. The problem is mapped to the weakness identified as CWE-732.

The Viidure Dashcam Android Application is affected, particularly the versions that use the central cloud storage backend described. No specific version numbers are provided in the advisory; therefore it applies to all releases that rely on the publicly exposed bucket.

The CVSS score of 8.7 indicates a high‑impact issue. The EPSS score is not available, but the bucket’s public‑read setting makes exploitation trivial over the internet without authentication, lowering the barrier to attack. While the vulnerability is not currently listed in the CISA KEV catalog, the ease of access and the sensitive data at risk suggest a significant threat if left unmitigated.