The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates.

#!/usr/bin/env python3
"""check_botslab.py - Detect Botslab G980H dashcams in your environment.

Checks:
1. Asset inventory CSV (if provided) for Botslab/G980H entries
2. Local network ARP table for known Botslab OUI prefixes

Usage:
  python3 check_botslab.py [--inventory /path/to/assets.csv] [--subnet 192.168.1.0/24]

Exit codes:
  0 = PATCHED   (no Botslab G980H devices found)
  1 = VULNERABLE (Botslab G980H devices detected)
  2 = UNKNOWN   (scan could not complete)
"""
import argparse
import csv
import subprocess
import sys
import re
import os

# Known Botslab-associated identifiers
BOTSLAB_KEYWORDS = ['botslab', 'g980h', 'g980hmc', 'qhg980h']
# Botslab devices often broadcast SSIDs matching this pattern
SSID_PATTERN = re.compile(r'botslab[_-]?g980', re.IGNORECASE)

def check_inventory(filepath):
    """Scan a CSV asset inventory for Botslab G980H entries."""
    found = []
    try:
        with open(filepath, 'r', encoding='utf-8-sig') as f:
            reader = csv.DictReader(f)
            for row in reader:
                row_text = ' '.join(str(v) for v in row.values()).lower()
                if any(kw in row_text for kw in BOTSLAB_KEYWORDS):
                    found.append(row)
    except Exception as e:
        print(f'[!] Could not read inventory file: {e}', file=sys.stderr)
    return found

def check_arp_table():
    """Check local ARP table for entries (best-effort, no active scan)."""
    found_macs = []
    try:
        if sys.platform == 'win32':
            result = subprocess.run(['arp', '-a'], capture_output=True, text=True, timeout=10)
        else:
            result = subprocess.run(['arp', '-a'], capture_output=True, text=True, timeout=10)
        if result.returncode == 0:
            # Look for any MACs; without confirmed OUI we just report the table size
            lines = result.stdout.strip().split('\n')
            print(f'[*] ARP table has {len(lines)} entries (manual OUI review recommended)')
    except Exception as e:
        print(f'[!] ARP scan failed: {e}', file=sys.stderr)
    return found_macs

def check_wifi_ssids():
    """Scan for WiFi SSIDs matching Botslab patterns."""
    found = []
    try:
        if sys.platform == 'darwin':
            result = subprocess.run(
                ['/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport', '-s'],
                capture_output=True, text=True, timeout=15)
        elif sys.platform == 'linux':
            result = subprocess.run(['iwlist', 'scan'], capture_output=True, text=True, timeout=30)
        elif sys.platform == 'win32':
            result = subprocess.run(['netsh', 'wlan', 'show', 'networks'], capture_output=True, text=True, timeout=15)
        else:
            print('[!] WiFi scan not supported on this platform', file=sys.stderr)
            return found
        
        if result.returncode == 0:
            for line in result.stdout.split('\n'):
                if SSID_PATTERN.search(line):
                    found.append(line.strip())
    except Exception as e:
        print(f'[!] WiFi scan failed: {e}', file=sys.stderr)
    return found

def main():
    parser = argparse.ArgumentParser(description='Detect Botslab G980H dashcams (CVE-2026-81630)')
    parser.add_argument('--inventory', help='Path to CSV asset inventory file')
    parser.add_argument('--subnet', help='Subnet to scan (requires root)', default=None)
    args = parser.parse_args()

    print('=== CVE-2026-81630: Botslab G980H Detection ===')
    print()

    vulnerable = False

    # Check 1: Inventory file
    if args.inventory:
        print(f'[*] Checking inventory: {args.inventory}')
        inv_results = check_inventory(args.inventory)
        if inv_results:
            print(f'[!] FOUND {len(inv_results)} Botslab G980H device(s) in inventory:')
            for r in inv_results:
                print(f'    -> {r}')
            vulnerable = True
        else:
            print('[+] No Botslab G980H devices found in inventory.')
    else:
        print('[*] No inventory file provided (use --inventory to check asset list)')

    print()

    # Check 2: WiFi SSID scan
    print('[*] Scanning for Botslab WiFi SSIDs...')
    ssids = check_wifi_ssids()
    if ssids:
        print(f'[!] FOUND {len(ssids)} Botslab WiFi network(s):')
        for s in ssids:
            print(f'    -> {s}')
        vulnerable = True
    else:
        print('[+] No Botslab WiFi SSIDs detected nearby.')

    print()

    # Check 3: ARP table review
    print('[*] Reviewing ARP table...')
    check_arp_table()

    print()
    print('=== RESULT ===')
    if vulnerable:
        print('VULNERABLE - Botslab G980H device(s) detected in your environment.')
        print('Action: Plan device replacement. No vendor patch exists.')
        sys.exit(1)
    else:
        print('PATCHED - No Botslab G980H devices detected.')
        print('Note: If you do not operate dashcam fleets, this CVE does not apply.')
        sys.exit(0)

if __name__ == '__main__':
    main()