Vulnerability Spotlight: Multiple vulnerabilities in the Roav A1 Dashcam

Summary: Cisco Talos disclosed multiple vulnerabilities in the Anker Roav A1 Dashcam and the Novatek NT9665X chipset firmware version "RoavA1_SW_V1.9", including stack-based buffer overflows in the WifiCmd Code 9999 and URL-parsing functions that allow arbitrary code execution, a default credential that users are not required to change, and an HTTP server that accepts arbitrary firmware uploads flashed on next reboot. Talos worked with Novatek to resolve some issues, but could not contact Anker, so TALOS-2018-0685, TALOS-2018-0687 and TALOS-2018-0688 remain unpatched.
Key Takeaway: Three of the reported flaws, including a default password users are never prompted to change, remain unpatched because the vendor could not be reached, and pairing two of the denial-of-service issues leaves the dashcam completely disabled until the battery runs out.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-4014 CVE-2018-4016 CVE-2018-4017 CVE-2018-4018 CVE-2018-4023 CVE-2018-4024 CVE-2018-4025 CVE-2018-4026
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026