CVE-2026-50099
Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jun 12, 2026
- Updated
- Jun 12, 2026
- Reserved
- Jun 8, 2026
Description
During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 4.6 Medium | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | icscert |
Weaknesses
- CWE-538 Insertion of sensitive information into Externally-Accessible file or directory
Affected Products
| Product | Versions |
|---|---|
Smart Doorbell X3Naxclow |
|
X Smart HomeNaxclow |
|
V720Naxclow |
|
ix camNaxclow |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.