CVE-2026-101055
Received Received - Intake

Information Disclosure in Thinkware U3000 via TCP Service

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the component TCP Service. The manipulation of the argument wifi_info results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101055
EUVD
EUVD-2026-88227

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thinkware u3000 to 1.02.04 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101055 is an information disclosure vulnerability in Thinkware U3000 dashcams up to firmware version 1.02.04. The flaw allows remote attackers to retrieve plaintext WiFi credentials (SSID and password) by sending a crafted GET_STATUS command with the wifi_info parameter via the TCP service on port 7878. No authentication or pairing is required.

Detection Guidance

To detect CVE-2026-101055, check if your Thinkware U3000 dashcam is running firmware versions v1.02.04 or v1.02.00. Use a network scanner to identify devices on port 7878. Send a GET_STATUS command with the wifi_info parameter (msg_id 2050) to the device. If it responds with SSID and plaintext WiFi password, the device is vulnerable.

Example command using netcat: echo -e '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' | nc <device_ip> 7878

Impact Analysis

This vulnerability allows attackers within network range to obtain your WiFi network credentials. With these credentials, they could gain unauthorized access to your network, potentially exploiting other vulnerabilities in connected devices or intercepting network traffic.

Mitigation Strategies

Immediately update the Thinkware U3000 firmware to the latest version if an update is available. If no update exists, isolate the device from your network to prevent unauthorized access. Disable remote access to the device if possible. Change the WiFi password on your router and any devices connected to it.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101055. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart