CVE-2026-94204

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: ICS-CERT

Description

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94204

Affected Vendors & Products

Vendor	Product	Version / Range
Viidure	Dashcam	Android Application 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

The vulnerability involves a misconfigured cloud storage bucket used by a dashcam platform. The bucket is set to public-read permissions, allowing anyone on the internet to access stored objects without authentication. This exposes sensitive data including user records, live dashcam footage, application packages, and firmware files.

Detection Guidance

Check for publicly accessible cloud storage buckets using tools like AWS CLI with commands such as 'aws s3 ls s3://bucket-name --no-sign-request' or 'aws s3api list-objects --bucket bucket-name --no-sign-request'. Use web browsers to access suspicious URLs or scan with tools like Nmap to detect open ports and services.

Impact Analysis

Unauthorized access to sensitive data such as personal user records, live dashcam footage, and firmware files could lead to privacy breaches, identity theft, or unauthorized surveillance. Attackers could exploit this to gather confidential information or disrupt services.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if health-related dashcam footage is exposed. It breaches data protection principles requiring secure storage and access controls for sensitive information.

Mitigation Strategies

Immediately restrict bucket permissions to private using cloud provider tools like 'aws s3api put-public-access-block' or 'gsutil iam ch -d allUsers gs://bucket-name'. Verify and remove public access policies with commands like 'aws s3api get-bucket-acl' or 'gsutil iam get gs://bucket-name'.

Hi! I’m here to help you understand CVE-2026-94204. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70