| Title | Thinkware U3000 up to 1.02.04 Improper Access Controls |
|---|
| Description | Thinkware U3000 dashcam, firmware up to and including v1.02.04. The device's local TCP control protocol (command socket 7878, data socket 8787) has no authentication of any kind. A command called PUT_FILE (msg_id 1286) writes attacker-supplied bytes to an attacker-supplied absolute path on the device's filesystem, with no path validation or restriction.
Any device on the same local network as the camera can complete the protocol's session handshake (no credentials required) and then send a PUT_FILE request specifying any absolute path. The camera writes the supplied content to that exact path and confirms success.
Verified by writing a test file directly to /tmp on the device, the same directory that holds the camera's own wpa_supplicant.conf (its live WiFi configuration). LS on /tmp confirmed the file was placed under the exact requested name, alongside genuine system files. GET_FILE on the same path read the content back for a byte-for-byte match against what was sent.
Confirmed on firmware v1.02.00 and re-confirmed after upgrading to the current production release, v1.02.04; behavior is identical on both.
Reported to Thinkware via [email protected] on 2026-06-21. Acknowledged the next business day with no technical response. No fix confirmed as of public disclosure. |
|---|
| Source | ⚠️ https://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/01-arbitrary-file-write.md |
|---|
| User | turret (UID 100496) |
|---|
| Submission | 08/13/2026 19:19 (2 months ago) |
|---|
| Moderation | 09/27/2026 18:29 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 410915 [Thinkware U3000 up to 1.02.04 TCP Service /tmp/wpa_supplicant.conf PUT_FILE path access control] |
|---|
| Points | 20 |
|---|