The Viidure Dashcam Android Application has two reported security flaws that could expose dashcam data and give attackers the ability to alter or delete files used by the platform. The first flaw makes the platform’s central cloud storage readable to anyone on the internet. The second embeds permanent cloud-storage credentials in the Android application, potentially providing broader control over operational files. CISA’s Sept. 29 advisory identifies both issues in the affected application and says no fix is planned.

What is known is the technical exposure described by CISA. CVE-2026-94204 concerns an incorrect permission assignment on the shared cloud storage backend. The storage location is configured for public read access, meaning an internet user does not need platform authorization to retrieve objects stored there. CISA says those objects include user records, live dashcam footage, application packages and firmware files. The advisory classifies the issue as a high-severity vulnerability, with a CVSS 3.1 score of 7.5 and a CVSS 4.0 score of 8.7.

That flaw is primarily a confidentiality problem. Public read access allows unauthorized viewing or copying of data, but the CVSS descriptions listed by CISA do not assign the vulnerability a direct impact on data integrity or availability. In practical terms, the reported permission error exposes information in the storage system without necessarily giving an unauthenticated reader permission to change or erase it through that specific weakness.

The second issue, CVE-2026-96587, works differently. The Android application contains permanent cloud-storage credentials in plaintext within its compiled code. Anyone who can obtain and inspect the application package may be able to recover those credentials. CISA says the credentials provide full access to critical platform storage, including the ability to read, modify or delete operational files such as firmware and application binaries.

That distinction matters because credentials are authorization material, not merely a path to publicly visible data. If the credentials remain valid and retain the permissions described in the advisory, an attacker could potentially use them to manipulate files that support the platform’s operation. CISA assigns this vulnerability a CVSS 3.1 score of 10 and a CVSS 4.0 score of 10, both in the critical category. The listed impacts include confidentiality, integrity and availability for the affected platform.

The two weaknesses can therefore be understood as separate failure modes in the same service. The public-read configuration removes the need for authorization to view stored objects. The hard-coded credentials expose a higher-privilege mechanism that may allow changes to storage contents. CISA’s summary says successful exploitation could allow attackers to access, modify or delete sensitive user data and critical system files, potentially compromising the operation of the entire platform. That summary describes the possible consequences of exploitation; it does not state that the entire platform has been compromised.

The affected product is identified as the Viidure Dashcam Android Application, with the product status listed as known affected. CISA places the product in the transportation systems sector and lists deployment as worldwide. The advisory identifies Viidure’s headquarters location as China. Those classifications describe the product and the advisory’s scope, but they do not establish that every user, vehicle or organization using the application has been affected in the same way.

Several important points remain unknown. CISA says no known public exploitation specifically targeting these vulnerabilities had been reported at the time of publication. That is a statement about reported exploitation, not proof that no unauthorized access occurred. The advisory does not identify a particular attacker, affected customer, stolen record, altered firmware image or confirmed incident. It also does not quantify how many users, devices, files or storage objects may be exposed.

The advisory does not provide a software version number that would let users distinguish a vulnerable release from a safe one. Instead, it identifies the application as affected and directs users of affected versions to contact Viidure customer support. CISA also says Viidure did not respond to its coordination attempts and lists no planned fix. As a result, the advisory does not describe a vendor-issued patch, credential rotation, storage-permission correction or other confirmed remediation.

For users and organizations deciding what to do, CISA recommends reducing network exposure for control-system devices and remote systems, placing them behind firewalls and isolating them from business networks. When remote access is necessary, CISA recommends more secure methods such as virtual private networks, while warning that VPNs and the devices connected through them also need to be kept current and protected. Those measures may reduce exposure around connected systems, but they do not by themselves demonstrate that the Viidure storage permissions or embedded credentials have been corrected.

CISA advises users of affected versions to contact Viidure customer support for additional information. Organizations that observe suspected malicious activity should follow their internal response procedures and report findings to CISA for tracking and correlation. Until a vendor remedy is identified, the central facts are that the advisory describes internet-readable shared storage, credentials embedded in the application, and a potential path to altering operational files, while reporting no known public exploitation specifically targeting these flaws at the time of publication.