Thinkware U3000 Pre-Auth WiFi Credential Disclosure via GET_STATUS (CVE-2026-101055)

Thinkware U3000 Vulnerability Summary Vulnerability Overview Vulnerability Name: Thinkware U3000: Plaintext WiFi Credential Disclosure via GET_STATUS "wifi_info" CVE ID: CVE-2026-101055 Disclosure Date: June 2026 Vulnerability Type: Plaintext WiFi Credential Disclosure Vulnerability Description: The command (parameters: , ) returns the camera's WiFi SSID and plaintext password to any client on the same local network, without requiring authentication or TLS encryption. Scope of Impact Affected Device: Thinkware U3000 dashcam Affected Components: TCP control protocol, command socket port 7878, no authentication, no TLS Affected Firmware: v1.02.04 (current production version); independently confirmed on v1.02.00 prior to upgrade Impact Scope: All findings have been confirmed against the base model Thinkware U3000; Thinkware also sells a standalone "U3000 Pro" variant, and whether it shares the same protocol implementation has not been tested. Security Impact: - Anyone within the camera's network range (or anyone who can reach this port) can retrieve the WiFi password without previously knowing it. - This represents a direct privilege escalation path: knowing this password provides network-level access, which can be used to exploit two other vulnerabilities (PUT_FILE arbitrary file write, GET_FILE / LS arbitrary file read). - In scenarios where the attacker does not yet have access, this vulnerability serves as an initial attack vector. Reproduction Steps 1. Complete the standard session handshake: → → 2. Send with parameter: 3. Response content: Relationship to Other WiFi Credential Disclosure Vulnerabilities Another mechanism-different vulnerability (see ) accesses the same credentials via a different path: reading the file on the device, with no path restrictions. This vulnerability is a generic file read primitive that happens to be able to read files containing credentials. Both vulnerabilities have been independently confirmed; fixing one does not necessarily fix the other. Remediation No specific remediation steps were provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Thinkware U3000 Pre-Auth WiFi Credential Disclosure via GET_STATUS (CVE-2026-101055)