CVE-2026-96587 PUBLISHED

Use of Hard-coded Credentials in Viidure Dashcam Android Application

Assigner: icscert
Reserved: 24.09.2026 Published: 29.09.2026 Updated: 29.09.2026

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 10

Product Status

Vendor Viidure
Product Dashcam Android Application
Versions Default: unaffected
  • affected from 0 to 3.3.1.260403 (incl.)

Workarounds

Viidure did not respond to CISA's coordination attempts. Users of affected versions of the Viidure Dashcam Android Application are advised to contact Viidure customer support for additional information https://viidure.app/. https://viidure.app/

Credits

  • Bugrahan Karahan reporter

References

Problem Types

  • CWE-798 Use of Hard-coded Credentials CWE