# CVE-2026-101055: Thinkware U3000 information disclosure in TCP service

Source: https://junglewise.ai/threats/cve-2026-101055-a-security-flaw-has-been-discovered-in-thinkware-u3000-up-to-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-101055 · Severity: medium · CVSS 5.3 · Published 2026-09-28

Thinkware U3000 dashcams contain a flaw in the TCP control service that leaks WiFi credentials in plaintext to any device on the same network. An attacker can retrieve the camera's WiFi password without authentication, enabling them to access the same network and launch further attacks on the device. The vendor has not responded to disclosure efforts.

Technologies: [Thinkware U3000](https://junglewise.ai/threats/technologies/u3000). Vendors: [Thinkware](https://junglewise.ai/threats/vendors/thinkware).

## Quick answers

**Is CVE-2026-101055 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101055 being exploited in the wild.

**How severe is CVE-2026-101055?** Medium severity, with a CVSS score of 5.3, published 28 September 2026.

**Which products and versions are affected?** Thinkware U3000 up to 1.02.04.

**Is there a fix for CVE-2026-101055?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101055 attacked?** It is attacked over the network or from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-101055?** Check whether you run Thinkware U3000 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The GET_STATUS command with the "wifi_info" parameter in the unauthenticated TCP service (port 7878) returns the camera's SSID and plaintext WiFi password without any authentication or pairing requirement. An attacker on the local network can complete a basic session handshake and retrieve credentials that grant access to escalate to other vulnerabilities including arbitrary file read and write. This vulnerability affects firmware versions up to 1.02.04 and has been publicly disclosed with proof-of-concept code available.

## Affected products

- Thinkware U3000 up to 1.02.04

## Timeline

- 2026-06: disclosed: Vulnerability disclosed by TurretSec
- 2026-09-28: advisory: CVE-2026-101055 published
- 2026-09-28: other: Public exploit code released on GitHub

## References

- [https://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/03-wifi-credential-disclosure.md](https://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/03-wifi-credential-disclosure.md)
- [https://vuldb.com/cve/CVE-2026-101055](https://vuldb.com/cve/CVE-2026-101055)

## Related threats

- [Thinkware U3000 arbitrary file read in TCP service](https://junglewise.ai/threats/cve-2026-101054-a-vulnerability-was-identified-in-thinkware-u3000-up-to-1-02-04)
- [Thinkware U3000 arbitrary file write in TCP service](https://junglewise.ai/threats/cve-2026-101053-a-vulnerability-was-determined-in-thinkware-u3000-up-to-1-02-04)