by Kastro
Paper/Archive/CVE-2026-96587

CVE-2026-96587

Viidure Dashcam Android Application — Use of Hard-coded Credentials in Viidure Dashcam Android Application

EPSS 0.4%CVSS 10.0
critical.is priorityof 100
37
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 35.9.359 × 207.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.

Affected

ProductAffectedFixed inSource
Dashcam Android Application≤ 3.3.1.260403–CNA

Scores by source

icscert (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refviidure.apprefcisa.gov/news-events/ics-advisories/icsa-26-272-07refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-07.json