Viidure Dashcam Android Application: 2 CVEs, Critical 10.0
Summary
CISA reports 2 vulnerabilities in Viidure Dashcam Android Application. Weakness types: Incorrect Permission Assignment for Critical Resource, Use of Hard-coded Credentials. Successful exploitation of these vulnerabilities could allow attackers to access, modify, or delete sensitive user data and critical system files, potentially compromising the operation of the entire platform. Highest CVSS v3 score: 10.0 (Critical), exploitable over the network.
At a glance
- Vendor
- Viidure
- Products
- Dashcam Android Application
- CVEs
- CVE-2026-94204, CVE-2026-96587
- Highest CVSS v3
- 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- China
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-94204 | Incorrect Permission Assignment for Critical Resource | 7.5 | – | No | The central cloud storage backend for the entire dashcam platform is misconfigured with public‑read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet. |
| CVE-2026-96587 | Use of Hard-coded Credentials | 10.0 | – | No | The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries. |
Affected products (1)
- Viidure Dashcam Android Application: <=3.3.1.260403
Vendor fixes and mitigations (from advisory)
- No Fix Planned: Viidure did not respond to CISA's coordination attempts. Users of affected versions of the Viidure Dashcam Android Application are advised to contact Viidure customer support for additional information https://viidure.app/. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.