| 标题 | Thinkware U3000 up to 1.02.04 Information Disclosure |
|---|
| 描述 | Thinkware U3000 dashcam, firmware up to and including v1.02.04. The device's local TCP control protocol (command socket 7878) has no authentication of any kind. A status query, GET_STATUS with param wifi_info (msg_id 2050), returns the camera's WiFi SSID and plaintext password directly to any client on the network.
Any device on the same local network as the camera can complete the protocol's session handshake (no credentials required) and then send this single status query to retrieve the camera's WiFi password without needing to already know it.
Verified directly: the returned password matched the camera's actual configured network credentials.
Confirmed on firmware v1.02.00 and re-confirmed after upgrading to the current production release, v1.02.04; behavior is identical on both.
Reported to Thinkware via [email protected] on 2026-06-21. Acknowledged the next business day with no technical response. No fix confirmed as of public disclosure. |
|---|
| 来源 | ⚠️ https://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/03-wifi-credential-disclosure.md |
|---|
| 用户 | turret (UID 100496) |
|---|
| 提交 | 2026-08-13 19時23分 (2 月前) |
|---|
| 管理 | 2026-09-27 18時29分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 410917 [Thinkware U3000 直到 1.02.04 TCP Service GET_STATUS wifi_info 信息公开] |
|---|
| 积分 | 20 |
|---|