An on-path attacker can replace a Botslab G980H firmware download with modified code the camera accepts and executes.

The updater trusts attacker-supplied integrity data; the boundary is one camera model and an on-path or authenticated update position.