{"id":"CVE-2026-101053","state":"PUBLISHED","title":"Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control","description":"A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-09-28T11:30:15.930Z","updatedAt":"2026-09-28T12:46:30.387Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Thinkware U3000"],"affected":[{"vendor":"Thinkware","product":"U3000","versions":[{"version":"1.02.04","status":"affected"}],"cpes":["cpe:2.3:a:thinkware:u3000:*:*:*:*:*:*:*:*"],"modules":["TCP Service"]}],"references":["https://vuldb.com/vuln/410915","https://vuldb.com/vuln/410915/cti","https://vuldb.com/cve/CVE-2026-101053","https://vuldb.com/submit/928042","https://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/01-arbitrary-file-write.md","https://github.com/tuhttps://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/02-arbitrary-file-read.mdrretsec/disclosure-thinkware-u3000/blob/main/findings/01-arbitrary-file-write.md"],"weaknesses":["CWE-284","CWE-266"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/101xxx/CVE-2026-101053.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-101053","state":"PUBLISHED","datePublished":"2026-09-28T11:30:15.930Z","dateUpdated":"2026-09-28T12:46:30.387Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-27T16:26:26.231Z"},"containers":{"cna":{"title":"Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control","descriptions":[{"lang":"en","value":"A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"Thinkware","product":"U3000","versions":[{"version":"1.02.04","status":"affected"}],"cpes":["cpe:2.3:a:thinkware:u3000:*:*:*:*:*:*:*:*"],"modules":["TCP Service"]}],"references":[{"url":"https://vuldb.com/vuln/410915","name":"VDB-410915 | Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/410915/cti","name":"VDB-410915 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-101053","name":"CVE-2026-101053 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/928042","name":"Submit #928042 | Thinkware U3000 up to 1.02.04 Improper Access Controls","tags":["third-party-advisory"]},{"url":"https://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/01-arbitrary-file-write.md","tags":["related"]},{"url":"https://github.com/tuhttps://github.com/turretsec/disclosure-thinkware-u3000/blob/main/findings/02-arbitrary-file-read.mdrretsec/disclosure-thinkware-u3000/blob/main/findings/01-arbitrary-file-write.md","tags":["broken-link","exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-09-28T11:30:15.930Z"},"timeline":[{"time":"2026-09-27T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-27T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-09-27T18:34:31.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"turret (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202609"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-28T12:46:18.617163Z","id":"CVE-2026-101053","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-28T12:46:30.387Z"}}]}}}