← Back to Feed

Viidure Dashcam Android Application

CVE-2026-94204CVE-2026-96587

September 29, 2026 · CISA (US-CERT) · Severity: CRITICAL

This advisory covers two vulnerabilities in the Viidure Dashcam Android application: a misconfigured cloud storage bucket with public read access and hardcoded credentials in the app code. These flaws can expose sensitive user records, live footage, and system files. CISA notes that Viidure has not responded to coordination attempts, so no fix is planned. 📌 **Analyst Note:** The combination of a public cloud bucket and hardcoded credentials creates a severe data exposure risk for all users and backend systems. Organizations using this dashcam should assume compromise and rotate any shared credentials, while also monitoring for unauthorized access to cloud storage.

Key Takeaways

  • The Viidure Dashcam Android application contains a publicly readable cloud storage bucket that exposes sensitive user data and firmware to anyone on the internet.
  • Hardcoded plaintext credentials embedded in the application allow attackers to access the cloud storage backend, compounding the exposure from misconfigured permissions.
  • These vulnerabilities affect transportation systems worldwide, and the vendor has not responded to CISA, leaving users without a planned fix.
☕ Buy a Coffee