| タイトル | Thinkware U3000 up to 1.02.04 Improper Access Controls |
|---|
| 説明 | Thinkware U3000 dashcam, firmware up to and including v1.02.04. The device's local TCP control protocol (command socket 7878, data socket 8787) has no authentication of any kind. Two commands, LS (msg_id 1282) and GET_FILE (msg_id 1285), list and read the contents of any absolute path on the device's filesystem with no restriction.
Any device on the same local network as the camera can complete the protocol's session handshake (no credentials required) and then use LS and GET_FILE to enumerate and read arbitrary files, not just recorded video.
Verified by reading /tmp/wpa_supplicant.conf directly from the device, which contains the camera's real WiFi SSID and plaintext password for the network it is joined to. LS on /tmp confirmed the file was present alongside other real system files. GET_FILE returned the full file content over the data socket.
Confirmed on firmware v1.02.00 and re-confirmed after upgrading to the current production release, v1.02.04; behavior is identical on both.
Reported to Thinkware via [email protected] on 2026-06-21. Acknowledged the next business day with no technical response. No fix confirmed as of public disclosure. |
|---|
| ソース | ⚠️ https://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/02-arbitrary-file-read.md |
|---|
| ユーザー | turret (UID 100496) |
|---|
| 送信 | 2026年08月13日 19:21 (2 月 ago) |
|---|
| モデレーション | 2026年09月27日 18:29 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 410916 [Thinkware U3000 迄 1.02.04 TCP Service /tmp/wpa_supplicant.conf get_file 特権昇格] |
|---|
| ポイント | 20 |
|---|