CVE-2026-16754
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese ma
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 05.02.31.140
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Lenovo Smart Camera C33
fixed in 05.02.31.140
- Lenovo Smart Camera C33 Pro
fixed in 05.02.31.140
- Lenovo Smart Camera C35
fixed in 05.02.31.140
- Lenovo Smart Camera RQ3
fixed in 05.02.31.140
- Lenovo Smart Camera XW1
fixed in 05.02.31.140
- Lenovo Smart Network PTZ X5T
fixed in 05.02.31.140
- Lenovo Smart Network PTZ X5Q
fixed in 05.02.31.140
- Lenovo Smart Network PTZ X5E
fixed in 05.02.31.140
- Lenovo Smart Camera X6T
fixed in 05.02.31.140
- Lenovo Smart Camera X6Q
fixed in 05.02.31.140
- Lenovo Smart Camera C5X
fixed in 05.02.31.140
- Lenovo Smart Camera X9T
fixed in 05.02.31.140