Skip to content
Fencer Vulns
medium 4.8

CVE-2026-16754 json

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese m…

published 2026-10-15 24 d ago modified 2026-10-16 23 d ago also EUVD-2026-102532

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 0%
public exploits
0
none known

Summary

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

Patch / fix

  • Lenovo Smart Camera C33 05.02.31.140
  • Lenovo Smart Camera C33 Pro 05.02.31.140
  • Lenovo Smart Camera C35 05.02.31.140
  • Lenovo Smart Camera RQ3 05.02.31.140
  • Lenovo Smart Camera XW1 05.02.31.140
  • Lenovo Smart Network PTZ X5T 05.02.31.140
  • Lenovo Smart Network PTZ X5Q 05.02.31.140
  • Lenovo Smart Network PTZ X5E 05.02.31.140
  • Lenovo Smart Camera X6T 05.02.31.140
  • Lenovo Smart Camera X6Q 05.02.31.140
  • Lenovo Smart Camera C5X 05.02.31.140
  • Lenovo Smart Camera X9T 05.02.31.140

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
23 d ago

Exploit prediction

0.07% chance of exploitation in the next 30 days, higher than 0% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.9 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA 3.1 4.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CNA 4.0 5.9 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Lenovo Smart Camera C33
  • Lenovo Smart Camera C33 Pro
  • Lenovo Smart Camera C35
  • Lenovo Smart Camera RQ3
  • Lenovo Smart Camera XW1
  • Lenovo Smart Network PTZ X5T
  • Lenovo Smart Network PTZ X5Q
  • Lenovo Smart Network PTZ X5E
  • Lenovo Smart Camera X6T
  • Lenovo Smart Camera X6Q
  • Lenovo Smart Camera C5X
  • Lenovo Smart Camera X9T

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.