CVE-2026-96587

🔴 Viidure dashcam app leaks cloud credentials, user data exposed worldwide Viidure Dashcam Android Application versions <=3.3.1.260403 contain two critical vulnerabilities (CVE-2026-94204, CVE-2026-96587) that expose sensitive user data and system files to unauthenticated internet access. The cloud storage backend is misconfigured with public-read permissions, allowing unrestricted access to dashcam footage, user records, application packages, and firmware.

🚨 #ALERT — VIIDURE DASHCAM ANDROID APP: TWO CVSS 10 FLAWS INCLUDE HARD-CODED CREDENTIALS AND CAN EXPOSE SENSITIVE DATA AND CRITICAL SYSTEM FILES September 29, 2026 DISCLOSED BY: CISA ICS PRODUCT: Viidure Dashcam Android Application CVE: CVE-2026-94204 CVE-2026-96587 IMPACT: Incorrect permission assignment for critical resources and use of hard-coded credentials. CISA states successful exploitation could allow attackers to access, modify, or delete sensitive user data and critical system files, potentially compromising the wider platform. CVSS: 10.0 Critical EXPLOITATION STATUS: VULNERABILITIES CONFIRMED NO CONFIRMED IN-THE-WILD EXPLOITATION IDENTIFIED Accuracy note: Hard-coded credentials are a serious credential/security-design flaw, but this advisory does not establish an active credential-theft or phishing campaign. URGENT ACTION: Stop using affected builds or upgrade to vendor-fixed releases when available. Review application permissions and associated credentials and investigate unexpected access to user data or critical files. SOURCE: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07 #CyberSecurity #ThreatIntel #Viidure #AndroidSecurity #HardcodedCredentials #MobileSecurity #CVE