Skip to content
OpenAdvisories
High · 7.3 Public exploit CVE-2026-101053 EUVD-2026-88221GHSA-88f2-4rrr-jgmw

Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control

Published Sep 28, 2026 · Updated Sep 28, 2026 · Assigned by VulDB

Vendor: Thinkware Product: U3000

Description

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

VendorProductAffectedFixed
Thinkware U3000 1.02.04 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • turretsec/u3000py ★ 1 · Aug 13, 2026

    Python client for the Thinkware U3000 dashcam's local WiFi control protocol, reverse-engineered from the official Android app. PoC tooling behind CVE-2026-101053, CVE-2026-101054, and CVE-2026-101055.

  • turretsec/disclosure-thinkware-u3000 ★ 0 · Aug 10, 2026

    Three unauthenticated vulnerabilities in the Thinkware U3000 dashcam's local WiFi control protocol: arbitrary file write, arbitrary file read, and plaintext WiFi credential disclosure. CVE-2026-10105…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References