Vulnerabilities · Application Security
Critical Flaws Found in Viidure Dashcam Android App Could Expose User Data
CISA warns that two severe vulnerabilities in the Viidure Dashcam Android app could let attackers access, change, or delete sensitive data. No public attacks are known yet, but users are urged to update and secure their devices.
Ross GrantUpdated 2 min read
The short version
CISA has found two serious security problems in the Viidure Dashcam Android app. If attackers exploit these flaws, they could access or change your data, or even control the dashcam. No attacks have been reported yet, but users should update and secure their devices.
What happened?
CISA has disclosed two critical vulnerabilities (CVE-2026-94204 and CVE-2026-96587) in the Viidure Dashcam Android Application, affecting versions up to 3.3.1.260403. These flaws could let attackers access, change, or delete sensitive data and system files. No public exploitation has been reported yet.
What are the vulnerabilities?
The US Cybersecurity and Infrastructure Security Agency (CISA) has published an advisory about two critical security flaws in the Viidure Dashcam Android Application. The affected versions are all releases up to and including 3.3.1.260403. The vulnerabilities are tracked as CVE-2026-94204 and CVE-2026-96587. According to CISA, successful exploitation could allow attackers to access, modify, or delete sensitive user data and system files. This could compromise the operation of the entire dashcam platform [CISA (opens in a new tab)].
How could attackers exploit these flaws?
The vulnerabilities stem from incorrect permission assignments for critical resources and the use of hard-coded credentials. Hard-coded credentials are usernames or passwords built directly into the app's code, making them easy for attackers to find and use. Incorrect permission assignments mean the app may give too much access to files or functions, which attackers can abuse. If exploited, attackers could gain control over sensitive information or even the dashcam's core functions.
Who is affected and what should users do?
Anyone using the Viidure Dashcam Android Application version 3.3.1.260403 or earlier is at risk. CISA recommends that users minimise network exposure, keep devices off the public internet, and place them behind firewalls. If remote access is needed, use a secure Virtual Private Network (VPN) and keep it updated. Users should also be cautious about phishing and social engineering attacks, such as suspicious emails or links. CISA has not reported any known public exploitation of these vulnerabilities so far.
What has CISA advised?
CISA urges users and organisations to follow best practices for securing industrial control systems. This includes performing risk assessments before deploying new security measures and reporting any suspicious activity to CISA. CISA also provides resources on its website for improving cybersecurity, including guides on defence-in-depth strategies and intrusion detection.
What is still unclear?
At this time, only CISA has reported on these vulnerabilities. There are no reports of active exploitation, and Viidure has not issued a public statement. It is not clear how many users are affected or whether a patch is available yet. Users should monitor official sources for updates and apply any patches as soon as they are released.
Claimed vs confirmed
- Confirmed
Attackers can access, modify, or delete sensitive user data and system files via the Viidure Dashcam Android app vulnerabilities.
CISA has confirmed this risk in its advisory.
- Confirmed
No public exploitation of these vulnerabilities has been reported.
CISA states there are no known public attacks at this time.
The impact
- Money
- If user data is exposed or systems are compromised, Viidure could face regulatory scrutiny and potential fines under data protection laws, depending on the affected regions.
- Reputation
- The discovery of critical flaws may damage trust in Viidure's products, especially if users are not quickly informed or protected.
- Customers
- Users of the affected app versions risk having their data accessed or altered. They should update their software and follow CISA's security advice.
Why it matters
These vulnerabilities could put user data and the operation of dashcams at risk. Anyone using the affected app versions should take steps to protect their devices and watch for updates. Attackers could use these flaws to steal data or disrupt services.
How does it work?
The vulnerabilities involve incorrect permission assignments for critical resources and the use of hard-coded credentials. This means the app may grant excessive access to files or functions, and attackers could use built-in usernames or passwords to gain unauthorised control.
Key points
- Two critical vulnerabilities affect Viidure Dashcam Android app versions up to 3.3.1.260403.
- Attackers could access, modify, or delete sensitive data and system files.
- No public exploitation has been reported yet.
- Users should secure devices, minimise internet exposure, and watch for updates.
- CISA recommends following best practices for industrial control system security.
Sources
CISA
Government
