| Название | Thinkware U3000 up to 1.02.04 Information Disclosure |
|---|
| Описание | Thinkware U3000 dashcam, firmware up to and including v1.02.04. The device's local TCP control protocol (command socket 7878) has no authentication of any kind. A status query, GET_STATUS with param wifi_info (msg_id 2050), returns the camera's WiFi SSID and plaintext password directly to any client on the network.
Any device on the same local network as the camera can complete the protocol's session handshake (no credentials required) and then send this single status query to retrieve the camera's WiFi password without needing to already know it.
Verified directly: the returned password matched the camera's actual configured network credentials.
Confirmed on firmware v1.02.00 and re-confirmed after upgrading to the current production release, v1.02.04; behavior is identical on both.
Reported to Thinkware via [email protected] on 2026-06-21. Acknowledged the next business day with no technical response. No fix confirmed as of public disclosure. |
|---|
| Источник | ⚠️ https://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/03-wifi-credential-disclosure.md |
|---|
| Пользователь | turret (UID 100496) |
|---|
| Представление | 13.08.2026 19:23 (2 месяцы назад) |
|---|
| Модерация | 27.09.2026 18:29 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 410917 [Thinkware U3000 до 1.02.04 TCP Service GET_STATUS wifi_info раскрытие информации] |
|---|
| Баллы | 20 |
|---|