EUVD-2026-88225
GHSA-mrrg-524v-2rf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device TCP service
-
ExploitSend get_file request for wpa_supplicant.conf
-
ExecutionImproper access control returns file
-
ImpactExfiltrate WiFi credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the Thinkware U3000 dashcam's TCP Service on firmware up to 1.02.04, with the get_file function reachable; no authentication, credentials, or user interaction are needed (PR:N/UI:N). Exploitation is limited primarily by network reachability of the device - the TCP service must be accessible to the attacker (e.g., same WiFi/LAN or exposed to a routable network). No non-default configuration is required per the description. The disclosed value is confidentiality-only: reading /tmp/wpa_supplicant.conf yields WiFi credentials; there is no integrity or availability impact. |
| Impact | This is a genuine but low-to-moderate severity issue whose real-world priority is dampened by product footprint, not by exploit difficulty. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes an easy, remote, unauthenticated attack, and E:P plus a public POC confirm working exploit code exists - so exploitation is technically trivial. However, the vendor-scored impact is confidentiality-only and rated Low (VC:L, VI:N, VA:N), producing a modest 5.5 score. I assess the confidentiality impact more aggressively: the read target /tmp/wpa_supplicant.conf holds WiFi credentials, and an arbitrary-file-read primitive (per the disclosure repo's '02-arbitrary-file-read' finding) warrants C:H rather than C:L, pushing my CVSS 3.1 estimate to ~7.5. No EPSS score and no CISA KEV listing are present, so there is no evidence of active or widespread exploitation despite the public POC - POC availability and active exploitation are distinct signals. The dominant risk-reducer is prevalence: a Korean consumer/automotive dashcam is a niche, low-footprint target. This is a real, easily-triggered flaw but not a fleet-wide emergency; treat as low priority absent Thinkware U3000 deployment. Note the vendor was unresponsive and no fix exists, so no patched version can be cited. |
| Exploit ScenarioDerived | An attacker with network reachability to the dashcam's TCP service invokes the get_file function to read /tmp/wpa_supplicant.conf without authentication, retrieving the stored WiFi SSID and pre-shared key. Publicly available exploit code (turretsec disclosure repo, '02-arbitrary-file-read') demonstrates the request. Given AV:N/AC:L/PR:N/UI:N, no user interaction or credentials are needed, and the recovered WiFi credentials can enable further network pivoting. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Improper access control in the TCP Service of Thinkware U3000 dashcams running firmware up to 1.02.04 lets a remote attacker call the get_file function and read arbitrary files, most notably /tmp/wpa_supplicant.conf, which holds the device's Wi-Fi credentials. The CVSS vector shows no authentication, no user interaction, and network reachability (PR:N/UI:N/AV:N), so any host that can reach the camera's TCP service on the LAN or a routable network can trigger it, and publicly available exploit code exists. The impact is confidentiality-only (no integrity or availability effect), and the practical risk is limited less by exploit difficulty than by the product's small deployment footprint and the fact that the attacker must first reach the device's TCP service.
RemediationAI
No vendor-released patch or fixed firmware version has been identified at the time of analysis: Thinkware was contacted about the disclosure and did not respond, and no advisory documenting a remediated build is referenced. Until a vendor fix appears, the primary control is to eliminate reachability of the vulnerable TCP Service - place the U3000 on an isolated or dedicated Wi-Fi/IoT VLAN and block inbound access to its TCP service from untrusted or routable networks, accepting that this may break the companion mobile app and any remote or cloud-facing features that rely on that service. Because the disclosed data is the camera's Wi-Fi credentials in /tmp/wpa_supplicant.conf, treat the camera's Wi-Fi network as compromised: use a unique, non-reused pre-shared key for the camera's network, rotate the PSK and any credentials that were shared with it, and avoid placing the camera on a network with other sensitive assets. Monitoring for unexpected connections to the dashcam's TCP port and for abnormal file-fetch traffic provides detection while a fix is pending, but does not prevent exploitation - only network segmentation and PSK rotation materially reduce exposure given that public exploit code exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-284 (Improper Access Control) in the get_file function exposed by the Thinkware U3000 dashcam's TCP Service. The function performs file retrieval without validating the caller's authorization or constraining the requested path, so a remote client can request any file on the device, including /tmp/wpa_supplicant.conf. That file is created and maintained by the wpa_supplicant daemon, which manages the camera's Wi-Fi supplicant state and stores the target access point's SSID and pre-shared key material in plaintext form - meaning a successful read discloses the Wi-Fi network credentials the camera uses. The affected product is captured by CPE cpe:2.3:a:thinkware:u3000:*:*:*:*:*:*:*:*, i.e., all tracked versions of the U3000 up to and including 1.02.04. The disclosure was reported through VulDB and published with accompanying exploit documentation on GitHub, and the vendor was contacted early but did not respond, so there is no vendor-supplied root-cause analysis or fix guidance to cross-reference.
Know when U3000 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Remote unauthenticated, no interaction (AV:N/AC:L/PR:N/UI:N); arbitrary read of a credential file justifies C:H; no write or availability impact so I:N/A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file of the file /tmp/wpa_supplicant.conf of the component TCP Service. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure in the Thinkware U3000 dashcam (firmware versions through 1.02.04) allows a remote, unauthenticat
Improper access control in the Thinkware U3000 dashcam (firmware through 1.02.04) allows remote, unauthenticated attacke
Exploit-DB