A flaw exists in the PUT_FILE function of the TCP Service on Thinkware U3000 devices, allowing remote actors to manipulate the path argument and write to the system file /tmp/wpa_supplicant.conf. The lack of proper access control enables an attacker to tamper with network configuration settings or inject malicious credentials, thereby compromising the integrity of the device's wireless configuration. This vulnerability does not grant direct code execution, but it provides a means to alter system‐level configuration files from a remote location.

Thinkware U3000 generation devices running firmware up to 1.02.04 are affected. The vulnerability applies to the TCP Service component in Thinkware U3000 units and does not appear to impact later releases beyond 1.02.04.

The CVSS score of 6.9 indicates a moderate severity. Public sources note that the exploit has been disclosed and may already be in use, though an EPSS score is not available. The vulnerability can be leveraged remotely via the TCP Service without authentication, and it is not currently listed in the CISA KEV catalog. Because the attack vector relies on network access to the TCP Service, organizations exposed to public or untrusted networks face a higher likelihood of exploitation.