CVE-2026-94204 & CVE-2026-96587: Critical CVSS 10 Flaws in Viidure Dashcam Android App — Detection and Remediation Guide

CISA has published ICSA-26-272-07, disclosing two vulnerabilities in the Viidure Dashcam Android Application — CVE-2026-94204 (Incorrect Permission Assignment for Critical Resource) and CVE-2026-96587 (Use of Hard-coded Credentials) — affecting all versions ≤ 3.3.1.260403. Both carry a CVSS v3 score of 10.0, the maximum possible severity. Successful exploitation could allow attackers to access, modify, or delete sensitive user data and critical system files, potentially compromising the operation of the entire platform — including the central cloud storage backend for the dashcam ecosystem.

If your organization operates vehicle fleets, allows these apps on corporate-managed or BYOD Android devices, or your transportation/logistics teams rely on dashcam footage for incident investigations and insurance claims, this is not a consumer-grade annoyance — it is a data integrity and privacy exposure with direct operational consequences. The affected product is deployed worldwide, the vendor is headquartered in China, and CISA has flagged it under the Transportation Systems critical infrastructure sector. Defenders need to inventory exposure today, not next quarter.

Technical Analysis

Affected Products and Versions

How the Vulnerabilities Work — Defender's View

CVE-2026-94204 — Incorrect Permission Assignment for Critical Resource (CWE-732). The central cloud storage backend for the dashcam platform assigns permissions incorrectly to critical resources. In practical terms, this class of flaw typically means that resources — recorded footage, telemetry, account data, or backend objects — are reachable or modifiable by actors who should have no such access. For a dashcam platform, that translates to unauthorized retrieval, tampering, or deletion of video evidence and user records. The phrase "compromising the operation of the entire platform" in the advisory indicates the exposure is not limited to a single user's account — it extends into shared backend infrastructure.

CVE-2026-96587 — Use of Hard-coded Credentials (CWE-798). Hard-coded credentials embedded in the mobile application are recoverable by anyone who decompiles or statically analyzes the APK. Depending on what those credentials protect — API keys, backend service accounts, storage buckets, or administrative endpoints — an attacker can pivot from a publicly distributed binary to authenticated access against the cloud backend without ever touching an end user's device. This is a recurring pattern in IoT and companion-app ecosystems, and it is why the CVSS score is at maximum: the barrier to exploitation is essentially "download the app and read it."

Attack chain, from the defender's perspective:

1. Attacker obtains the Viidure APK from any public distribution channel.
2. Static analysis extracts hard-coded credentials (CVE-2026-96587).
3. Credentials are replayed against the cloud storage backend; incorrectly assigned permissions (CVE-2026-94204) allow access to resources beyond what the credential should authorize.
4. Result: read/modify/delete against sensitive user data and critical system files — footage destruction, evidence tampering, privacy breach, and potential platform-level disruption.

Exploitation Status

As of publication of ICSA-26-272-07, CISA has not reported confirmed in-the-wild exploitation of these vulnerabilities, and they are not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, do not mistake "no known exploitation" for "low priority." Hard-coded credentials in a publicly distributed mobile binary are trivially discoverable, and a CVSS 10.0 backend-permission flaw in a worldwide-deployed platform is exactly the kind of target that gets reverse-engineered within days of disclosure. Treat the window between advisory publication and your remediation as the exposure period.

Detection & Response

Detection for this advisory is less about catching an exploit payload and more about finding exposure: outdated app versions on managed devices, Viidure cloud-backend traffic on your network, and forensic artifacts during device audits. The rules below are tuned to that reality — they look for the product and version fingerprints, not speculative exploit strings.

---
title: Viidure Dashcam Cloud Backend Communication Detected
description: Detects DNS resolution attempts for Viidure-related domains, indicating presence of the vulnerable dashcam application or companion devices communicating with the vendor cloud backend. Useful for asset inventory and exposure scoping per CISA ICSA-26-272-07.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07
author: Security Arsenal
date: 2026/04/10
status: experimental
id: 3b8f2a41-7c19-4e56-b9d2-1a5c7e8f9034
tags:
  - attack.discovery
logsource:
  category: dns
  product: windows
detection:
  selection:
    QueryName|contains:
      - 'viidure'
falsepositives:
  - Security research or vulnerability management validation of the advisory
level: low
---
title: Vulnerable Viidure Dashcam App Version in Mobile Telemetry
description: Detects Viidure Dashcam Android application package telemetry indicating an installed version at or below 3.3.1.260403, which is vulnerable to CVE-2026-94204 and CVE-2026-96587 per CISA ICSA-26-272-07. Intended for MDM/metro log pipelines forwarding Android package inventory into SIEM.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07
author: Security Arsenal
date: 2026/04/10
status: experimental
id: 9c1e5d72-4b08-4f31-a67c-2d8b0f4e5172
tags:
  - attack.initial_access
logsource:
  product: android
detection:
  selection_app:
    - 'viidure'
  selection_version:
    - '3.3.1.260403'
    - '3.3.0'
    - '3.2.'
    - '3.1.'
    - '3.0.'
    - '2.'
  condition: selection_app and selection_version
falsepositives:
  - Inventory scans confirming remediation status
level: medium

// Hunt: Viidure Dashcam exposure — DNS traffic and Android device inventory
// Scope assets communicating with vendor backend and identify vulnerable installs
// Reference: CISA ICSA-26-272-07 | CVE-2026-94204, CVE-2026-96587

// 1. Network exposure: DNS queries to Viidure infrastructure (proxies, DNS logs, CEF-ingested firewalls)
union isfuzzy=true
    (DnsEvents
    | where Name contains "viidure"
    | summarize QueryCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ClientIP, Name),
    (CommonSecurityLog
    | where DestinationHostName contains "viidure" or RequestURL contains "viidure"
    | summarize EventCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationHostName, RequestURL)

// 2. Endpoint exposure: Android devices reporting Viidure package installs via Defender/MDM telemetry
// Run separately — join device inventory to flagged software inventory
// DeviceInfo
// | where DeviceType == "Android" or OSPlatform has "Android"
// | summarize arg_max(TimeGenerated, *) by DeviceId
// | project DeviceName, OSPlatform, OSVersion, LoggedOnUsers

-- Hunt for Viidure Dashcam APK artifacts and ADB transfer activity on endpoints
-- Supports asset inventory and BYOD-forensics scoping for ICSA-26-272-07
-- Looks for APK files referencing Viidure and evidence of adb-based sideloading

SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/**/viidure*.apk', 'C:/Users/*/Downloads/*viidure*', 'C:/Users/*/Downloads/*.apk'])
WHERE FullPath =~ 'viidure'
ORDER BY Mtime DESC

-- Second artifact: enumerate ADB processes used to interact with Android devices
-- SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
-- FROM pslist()
-- WHERE Name =~ 'adb' OR CommandLine =~ 'adb (install|shell|push)'

#!/bin/bash
# Viidure Dashcam exposure audit — ADB-based version check for managed Android devices
# Reference: CISA ICSA-26-272-07 | Affected: <= 3.3.1.260403
# Usage: connect device via ADB (USB or network), then run this script.

VULNERABLE_MAX="3.3.1.260403"

echo "[*] Enumerating installed packages for Viidure..."
PKG=$(adb shell pm list packages 2>/dev/null | grep -i viidure | cut -d: -f2 | tr -d '\r')

if [ -z "$PKG" ]; then
    echo "[+] No Viidure package found on this device."
    exit 0
fi

echo "[!] Viidure package detected: $PKG"
VERSION=$(adb shell dumpsys package "$PKG" 2>/dev/null | grep -m1 versionName | cut -d= -f2 | tr -d ' \r')
echo "[*] Installed version: $VERSION"

# Flag known-vulnerable version ranges (3.3.1.260403 and earlier)
if [[ "$VERSION" == "3.3.1.260403" || "$VERSION" < "3.3.1.260403" ]]; then
    echo "[CRITICAL] Device is running a VULNERABLE version (<= $VULNERABLE_MAX)."
    echo "[ACTION] Update via Play Store immediately, or uninstall: adb shell pm uninstall $PKG"
else
    echo "[+] Version appears newer than the vulnerable range — verify against vendor advisory."
fi

# Audit granted permissions for excessive access (context for CVE-2026-94204 impact)
echo "[*] Granted permissions:"
adb shell dumpsys package "$PKG" 2>/dev/null | grep -A50 "granted=true" | grep permission | sort -u

Remediation

1. Update immediately. Upgrade the Viidure Dashcam Android Application to a version newer than 3.3.1.260403 via the Google Play Store or the vendor's official distribution channel. Verify the installed version post-update — do not assume auto-update has fired on managed or kiosk devices.
2. Enforce via MDM. Push a compliance policy in your mobile device management platform (Intune, Workspace ONE, etc.) that flags or blocks devices running Viidure ≤ 3.3.1.260403, and quarantine non-compliant devices until remediated.
3. If the app is not business-required, remove it. Dashcam companion apps on corporate devices are a data-leakage surface even when patched. Uninstall where there is no operational need.
4. Assume credential compromise. Because CVE-2026-96587 involves hard-coded credentials in a publicly distributed binary, treat any backend credentials embedded in the affected app versions as exposed. If your organization holds a Viidure account, rotate passwords and review account activity; pressure the vendor to rotate the embedded backend credentials and confirm whether they were scoped to per-user or shared backend resources.
5. Audit footage and data integrity. If dashcam footage supports insurance claims, litigation, or incident investigations, verify the integrity of recordings stored in the Viidure cloud backend for the period the vulnerable version was deployed. Flag gaps, deletions, or anomalous modification timestamps.
6. Restrict network exposure. Follow CISA's standing ICS guidance: minimize network exposure for such devices, ensure they are not reachable from the internet where avoidable, and place mobile/IoT companion devices behind segmented networks with monitored egress.
7. Monitor the KEV catalog. These CVEs are not in KEV today; given the CVSS 10.0 rating and trivial discoverability of hard-coded credentials, watch for a status change and escalate response priority immediately if one is added.
8. Track the vendor advisory. Monitor CISA ICSA-26-272-07 for updates and demand a fixed-version confirmation and credential-rotation statement from Viidure before re-approving the app for fleet or BYOD use.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub