CVE-2026-101055: Thinkware U3000 TCP Service GET_STATUS information disclosure
A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GETSTATUS of the component TCP Service. The manipulation of the argument wifiinfo results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which devices are affected?
Thinkware U3000 devices running version 1.02.04 or earlier are affected.
Does exploitation require authentication or user interaction?
No. The vulnerability is remotely exploitable with no privileges or user interaction required.
What information is exposed?
The issue is an information disclosure in the TCP Service GET_STATUS function when the wifi_info argument is manipulated. The provided data does not identify the specific information that can be disclosed.
Is public exploit code available?
Yes. An exploit has been publicly released and may be used in attacks.
Is a vendor fix available?
The provided data does not identify a fix. It states that the vendor was contacted early about the disclosure but did not respond.