U3000
Monthly
Information disclosure in the Thinkware U3000 dashcam (firmware versions through 1.02.04) allows a remote, unauthenticated attacker to retrieve stored Wi-Fi credentials by sending a crafted GET_STATUS request with a manipulated wifi_info argument to the device's TCP service. Publicly available exploit code exists, including a full technical write-up in the researcher's GitHub disclosure repository, so the technique is trivially reproducible, though practical exposure requires reaching the dashcam's TCP service over the local/Wi-Fi network it is joined to. CVSS 4.0 scores it 6.9 with E:P, and our own assessment (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) characterises it as a genuine but low-priority issue because confidentiality impact is real but integrity and availability are unaffected.
Improper access control in the TCP Service of Thinkware U3000 dashcams running firmware up to 1.02.04 lets a remote attacker call the get_file function and read arbitrary files, most notably /tmp/wpa_supplicant.conf, which holds the device's Wi-Fi credentials. The CVSS vector shows no authentication, no user interaction, and network reachability (PR:N/UI:N/AV:N), so any host that can reach the camera's TCP service on the LAN or a routable network can trigger it, and publicly available exploit code exists. The impact is confidentiality-only (no integrity or availability effect), and the practical risk is limited less by exploit difficulty than by the product's small deployment footprint and the fact that the attacker must first reach the device's TCP service.
Improper access control in the Thinkware U3000 dashcam (firmware through 1.02.04) allows remote, unauthenticated attackers to abuse the TCP Service's PUT_FILE operation - manipulating its path argument - to read and write arbitrary files, including /tmp/wpa_supplicant.conf. Because no authentication, user interaction, or special configuration is required once the service is reachable (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, and the independent assessment's CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), the practical barrier is exposure: an attacker must have a network path to the dashcam's TCP service, typically via its own Wi-Fi hotspot or a LAN it is bridged to, which limits internet-wide exploitation. Publicly available exploit code exists (published in the Turretsec disclosure), and the vendor was contacted but did not respond, so no fix is available; there is no CISA KEV listing, so active exploitation is not confirmed.
Information disclosure in the Thinkware U3000 dashcam (firmware versions through 1.02.04) allows a remote, unauthenticated attacker to retrieve stored Wi-Fi credentials by sending a crafted GET_STATUS request with a manipulated wifi_info argument to the device's TCP service. Publicly available exploit code exists, including a full technical write-up in the researcher's GitHub disclosure repository, so the technique is trivially reproducible, though practical exposure requires reaching the dashcam's TCP service over the local/Wi-Fi network it is joined to. CVSS 4.0 scores it 6.9 with E:P, and our own assessment (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) characterises it as a genuine but low-priority issue because confidentiality impact is real but integrity and availability are unaffected.
Improper access control in the TCP Service of Thinkware U3000 dashcams running firmware up to 1.02.04 lets a remote attacker call the get_file function and read arbitrary files, most notably /tmp/wpa_supplicant.conf, which holds the device's Wi-Fi credentials. The CVSS vector shows no authentication, no user interaction, and network reachability (PR:N/UI:N/AV:N), so any host that can reach the camera's TCP service on the LAN or a routable network can trigger it, and publicly available exploit code exists. The impact is confidentiality-only (no integrity or availability effect), and the practical risk is limited less by exploit difficulty than by the product's small deployment footprint and the fact that the attacker must first reach the device's TCP service.
Improper access control in the Thinkware U3000 dashcam (firmware through 1.02.04) allows remote, unauthenticated attackers to abuse the TCP Service's PUT_FILE operation - manipulating its path argument - to read and write arbitrary files, including /tmp/wpa_supplicant.conf. Because no authentication, user interaction, or special configuration is required once the service is reachable (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, and the independent assessment's CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), the practical barrier is exposure: an attacker must have a network path to the dashcam's TCP service, typically via its own Wi-Fi hotspot or a LAN it is bridged to, which limits internet-wide exploitation. Publicly available exploit code exists (published in the Turretsec disclosure), and the vendor was contacted but did not respond, so no fix is available; there is no CISA KEV listing, so active exploitation is not confirmed.