EUVD-2026-88227
GHSA-f8xp-75j9-8j3c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach dashcam TCP service on network
-
ExploitSend GET_STATUS with wifi_info argument
-
ExecutionDevice returns WiFi info/credentials
-
ImpactHarvest credentials to pivot to owner network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the Thinkware U3000's TCP Service and the ability to send a crafted GET_STATUS request manipulating the wifi_info argument; no authentication or user interaction is needed (PR:N/UI:N). The practical limiting factor is exposure: the dashcam's TCP service is typically reachable only from the local/WiFi network the device is on rather than the public internet, so an attacker generally must first gain proximity to or a foothold on that network. Affects firmware up to and including 1.02.04, and no vendor fix is available. |
| Impact | This is a genuine but low-priority issue. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, E:P/POC public) indicates trivial remote unauthenticated exploitation over the network with no user interaction, and public exploit code is confirmed in the turretsec disclosure repo - a real, reproducible weakness rather than a theoretical one. However, the vendor scored impact conservatively as VC:L only (confidentiality-low, no integrity/availability), yielding 6.9. Given the disclosed feature is GET_STATUS returning wifi_info - the WiFi network configuration/credentials of the dashcam - I assess confidentiality impact higher (C:H) because leaking WiFi credentials can pivot to the owner's home/vehicle network. No EPSS score and no CISA KEV listing are provided; POC availability is NOT the same as active exploitation, and there is no evidence of in-the-wild use. The dominant risk-limiting factor is prevalence and exposure: a consumer/automotive dashcam whose TCP service is only reachable by an attacker already on the same local/WiFi network in typical deployments, not internet-wide, which caps real-world risk despite the clean PR:N/AC:L vector. Vendor was contacted but did not respond, so no fix exists. |
| Exploit ScenarioDerived | An attacker within network range of a Thinkware U3000 dashcam (e.g., joined to or adjacent to its WiFi) connects to the exposed TCP service and issues a GET_STATUS request manipulating the wifi_info argument, causing the device to return its WiFi network information/credentials. Public exploit code for this exact finding is available in the turretsec disclosure repository, making reproduction straightforward with no authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Information disclosure in the Thinkware U3000 dashcam (firmware versions through 1.02.04) allows a remote, unauthenticated attacker to retrieve stored Wi-Fi credentials by sending a crafted GET_STATUS request with a manipulated wifi_info argument to the device's TCP service. Publicly available exploit code exists, including a full technical write-up in the researcher's GitHub disclosure repository, so the technique is trivially reproducible, though practical exposure requires reaching the dashcam's TCP service over the local/Wi-Fi network it is joined to. CVSS 4.0 scores it 6.9 with E:P, and our own assessment (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) characterises it as a genuine but low-priority issue because confidentiality impact is real but integrity and availability are unaffected.
RemediationAI
No vendor-released patch is identified at the time of analysis - the vendor was contacted early and did not respond, so there is no fixed firmware version to upgrade to. Because the flaw is a missing authorization check on the TCP service's GET_STATUS handler, the only reliable mitigation is exposure reduction: keep the dashcam off untrusted or public Wi-Fi networks, place it on a segmented SSID/VLAN isolated from other assets, and block inbound TCP access to the device's management/service ports from anything other than the trusted companion app or admin host; this limits the attack to devices already on the camera's own network segment, which is exactly the exposure the public exploit code could otherwise exploit. Treat any Wi-Fi credential previously configured on a U3000 as compromised - rotate the affected Wi-Fi network's pre-shared key and, if the same credentials are reused anywhere else, change them there too, since the disclosure's entire impact is credential theft. Monitor the VulDB entry (https://vuldb.com/vuln/410917) and the researcher's repository (https://github.com/turretsec/disclosure-thinkware-u3000) for vendor updates, and press Thinkware for a firmware fix; until one ships, physical/network isolation is the only compensating control and it carries the trade-off of losing remote cloud/companion-app functionality if the device is fully isolated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Thinkware U3000 is a connected dashcam running embedded firmware that exposes a TCP service used for device management and companion-app interaction. The vulnerability is a classic CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) in the GET_STATUS handler: the wifi_info argument is passed through to the status response without authorization checks or output sanitisation, so the service returns the device's stored Wi-Fi configuration - including credentials - to any client that can reach the port. Both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L, E:P) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) agree that no authentication (PR:N) or user interaction (UI:N) is required and that only confidentiality is impacted; the difference in scored severity comes from the v3.1 assessment weighting the credential leak as high confidentiality impact. The CPE cpe:2.3:a:thinkware:u3000:*:*:*:*:*:*:*:* reflects that the vendor has not published a fixed firmware version, so all known releases up to and including 1.02.04 are presumed affected.
Know when U3000 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Remote unauthenticated request with no interaction (AV:N/AC:L/PR:N/UI:N); confidentiality raised to C:H because leaked wifi_info exposes WiFi credentials, with no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the component TCP Service. The manipulation of the argument wifi_info results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Improper access control in the TCP Service of Thinkware U3000 dashcams running firmware up to 1.02.04 lets a remote atta
Improper access control in the Thinkware U3000 dashcam (firmware through 1.02.04) allows remote, unauthenticated attacke
Exploit-DB