Viidure Dashcam Android Application
Plan PatchCVSS 10ICS-CERT ICSA-26-272-07Sep 29, 2026
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
The Viidure Dashcam Android Application contains multiple critical vulnerabilities (CWE-732: Incorrect Permission Assignment, CWE-798: Use of Hard-Coded Credentials) that allow attackers to access, modify, or delete sensitive user data and critical system files without authentication. Affected versions are 3.3.1.260403 and earlier. The vendor did not respond to CISA coordination attempts.
What this means
What could happen
An attacker could remotely access and modify dashcam video files, user credentials, and configuration data without any authentication, potentially compromising vehicle security footage and exposing sensitive personal information. If the dashcam is integrated into fleet management or connected vehicle systems, this could affect operational visibility and compliance record-keeping.
Who's at risk
Fleet managers and vehicle operators using Viidure Dashcam for vehicle security monitoring, accident documentation, or compliance record-keeping. This primarily affects organizations using dashcams for fleet telematics, insurance verification, or operational safety documentation in logistics, delivery, public transportation, and utility vehicle fleets.
How it could be exploited
An attacker with network access to the device (or via a malicious app on the same Android device) can exploit incorrect file permissions or hard-coded credentials to directly access the application's data storage and system files. No authentication is required, and the attack requires only network connectivity to the device.
Prerequisites
- Network access to the Android device running the vulnerable Viidure Dashcam application
- No credentials required
remotely exploitableno authentication requiredlow complexityno patch availablehard-coded credentialsinsecure file permissions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (1)
ProductAffected VersionsFix Status
Dashcam Android Application≤ 3.3.1.260403No fix (EOL)
Remediation & Mitigation
0/4
Do now
0/2WORKAROUNDUninstall or disable the Viidure Dashcam Android Application on all fleet vehicles and devices
HARDENINGIf continued use is unavoidable, isolate dashcam devices on a separate network segment with restricted outbound access to prevent lateral movement if compromised
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXMigrate to an alternative dashcam or fleet monitoring solution that has active vendor support and receives security updates
WORKAROUNDAudit all video footage and data stored by the Viidure application for unauthorized access or modification
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/cd285239-c8b2-469e-b6a5-a312844085cfGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.