CVE-2026-50099
During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.1
- CVSS vector
- CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.17%
- CWE
- CWE-538
- Published
- 2026-06-12
- Last modified
- 2026-06-12
Affected products
- Naxclow Smart Doorbell X3
- Naxclow X Smart Home
- Naxclow V720
- Naxclow ix cam
Weakness type
Related vulnerabilities
- CVE-2026-80175 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-69507 — Microsoft Windows Search Component Information Disclosure Vulnerability
- CVE-2026-67361 — Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- CVE-2026-19229 — SourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosure
- CVE-2026-12762 — Insertion of Sensitive Information into Externally-Accessible File in IBM Business Automation Insights
- CVE-2026-15574 — Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug default
- CVE-2025-36372 — IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables
- CVE-2026-50565 — Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container