| عنوان | Thinkware U3000 up to 1.02.04 Information Disclosure |
|---|
| الوصف | Thinkware U3000 dashcam, firmware up to and including v1.02.04. The device's local TCP control protocol (command socket 7878) has no authentication of any kind. A status query, GET_STATUS with param wifi_info (msg_id 2050), returns the camera's WiFi SSID and plaintext password directly to any client on the network.
Any device on the same local network as the camera can complete the protocol's session handshake (no credentials required) and then send this single status query to retrieve the camera's WiFi password without needing to already know it.
Verified directly: the returned password matched the camera's actual configured network credentials.
Confirmed on firmware v1.02.00 and re-confirmed after upgrading to the current production release, v1.02.04; behavior is identical on both.
Reported to Thinkware via [email protected] on 2026-06-21. Acknowledged the next business day with no technical response. No fix confirmed as of public disclosure. |
|---|
| المصدر | ⚠️ https://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/03-wifi-credential-disclosure.md |
|---|
| المستخدم | turret (UID 100496) |
|---|
| ارسال | 13/08/2026 07:23 PM (2 أشهر منذ) |
|---|
| الاعتدال | 27/09/2026 06:29 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 410917 [Thinkware U3000 حتى 1.02.04 TCP Service GET_STATUS wifi_info الكشف عن المعلومات] |
|---|
| النقاط | 20 |
|---|