CVE-2026-101053: Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control
A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which devices should be considered affected?
Thinkware U3000 devices running firmware up to and including 1.02.04 should be considered affected.
Does exploitation require authentication or user interaction?
The supplied vector indicates that the issue can be exploited remotely with no privileges and no user interaction required. Exposure depends on an attacker being able to reach the affected TCP service.
Is public exploit information available?
Yes. The vulnerability description states that an exploit has been publicly disclosed and may be used.
Is a vendor fix or workaround available?
No vendor fix or workaround is identified in the provided information. The vendor was contacted early about the disclosure but did not respond.