Thinkware U3000 CVE-2026-101053

Requires network access to the Thinkware U3000's TCP Service and the ability to invoke its PUT_FILE operation with a manipulated path argument; per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special configuration is needed once the service is reachable. The primary limiting factor is exposure: an attacker must be on a network path to the dashcam's TCP service (typically the device's own WiFi/hotspot or a LAN it is bridged to), which constrains internet-wide exploitation. Affected firmware is versions up to and including 1.02.04, and no vendor fix is available.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) describes a remotely reachable, unauthenticated flaw of low attack complexity requiring no user interaction - an inherently attractive profile. The 6.9 score is held down by the vendor rating all impact metrics Low (VC:L/VI:L/VA:L), but this appears understated: the two linked findings describe unauthenticated arbitrary file WRITE (path argument manipulation in the TCP Service PUT_FILE operation) plus a companion arbitrary file READ, which on an embedded device typically enables credential theft (wpa_supplicant.conf holds WiFi PSKs) and configuration tampering that can escalate to code execution - I assess High confidentiality/integrity impact. Publicly available exploit code exists (POC=YES via the turretsec disclosure repo), but there is NO CISA KEV listing and NO EPSS score in the input, so this is 'publicly available exploit code exists' - not confirmed active exploitation. Net: technically a real, easily-triggered unauthenticated flaw with public PoC, tempered by a niche consumer-dashcam footprint and no evidence of in-the-wild use, so real-world priority is moderate rather than urgent. Note the conflict: vendor scores impact Low, but the described arbitrary file read/write primitives justify a materially higher impact - treat the vendor 6.9 as a floor, not a ceiling.

An attacker with network reachability to the dashcam's exposed TCP service (e.g., over the device's WiFi/AP or an exposed LAN interface) sends a crafted PUT_FILE request that manipulates the target path argument to write or read arbitrary files, such as /tmp/wpa_supplicant.conf. This yields disclosure of stored WiFi credentials and the ability to overwrite device configuration files, all without authentication. Public exploit code and a write-up are already published in the turretsec disclosure repository.