The vulnerability resides in the TCP Service's get_file function, which accesses /tmp/wpa_supplicant.conf without adequate access control. An attacker can request this file remotely, enabling the extraction of sensitive configuration data and potentially other files on the device. The weakness matches CWE-284 and CWE-266, exposing the device to confidentiality loss and privilege escalation if combined with other flaws.

Thinkware U3000 devices, firmware versions up to 1.02.04, are affected. The vulnerability applies to all builds running the default TCP Service component that includes the unprotected get_file routine.

With a CVSS score of 6.9, the vulnerability falls into the moderate severity range. The exploit is publicly available and exploits remote access via the TCP Service, requiring no local privilege. EPSS is not available, but the existence of a public exploit indicates non-negligible risk. The vendor has not yet issued a KEV listing, but the presence of an exploit on public channels stresses the need for mitigation.