| タイトル | Thinkware U3000 up to 1.02.04 Improper Access Controls |
|---|
| 説明 | Thinkware U3000 dashcam, firmware up to and including v1.02.04. The device's local TCP control protocol (command socket 7878, data socket 8787) has no authentication of any kind. A command called PUT_FILE (msg_id 1286) writes attacker-supplied bytes to an attacker-supplied absolute path on the device's filesystem, with no path validation or restriction.
Any device on the same local network as the camera can complete the protocol's session handshake (no credentials required) and then send a PUT_FILE request specifying any absolute path. The camera writes the supplied content to that exact path and confirms success.
Verified by writing a test file directly to /tmp on the device, the same directory that holds the camera's own wpa_supplicant.conf (its live WiFi configuration). LS on /tmp confirmed the file was placed under the exact requested name, alongside genuine system files. GET_FILE on the same path read the content back for a byte-for-byte match against what was sent.
Confirmed on firmware v1.02.00 and re-confirmed after upgrading to the current production release, v1.02.04; behavior is identical on both.
Reported to Thinkware via [email protected] on 2026-06-21. Acknowledged the next business day with no technical response. No fix confirmed as of public disclosure. |
|---|
| ソース | ⚠️ https://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/01-arbitrary-file-write.md |
|---|
| ユーザー | turret (UID 100496) |
|---|
| 送信 | 2026年08月13日 19:19 (2 月 ago) |
|---|
| モデレーション | 2026年09月27日 18:29 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 410915 [Thinkware U3000 迄 1.02.04 TCP Service /tmp/wpa_supplicant.conf PUT_FILE path 特権昇格] |
|---|
| ポイント | 20 |
|---|