Vulnerability · Published Oct 15, 2026 · Assigned by lenovo
CVE-2026-16754
Medium 4.8
In plain English
A medium-severity improper certificate validation in Smart Camera C33 from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)<0.1%top 99.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Smart Camera C33 | 0 – before 05.02.31.140 |
| Lenovo | Smart Camera C33 Pro | 0 – before 05.02.31.140 |
| Lenovo | Smart Camera C35 | 0 – before 05.02.31.140 |
| Lenovo | Smart Camera RQ3 | 0 – before 05.02.31.140 |
| Lenovo | Smart Camera XW1 | 0 – before 05.02.31.140 |
| Lenovo | Smart Network PTZ X5T | 0 – before 05.02.31.140 |
| Lenovo | Smart Network PTZ X5Q | 0 – before 05.02.31.140 |
| Lenovo | Smart Network PTZ X5E | 0 – before 05.02.31.140 |
| Lenovo | Smart Camera X6T | 0 – before 05.02.31.140 |
| Lenovo | Smart Camera X6Q | 0 – before 05.02.31.140 |
| Lenovo | Smart Camera C5X | 0 – before 05.02.31.140 |
| Lenovo | Smart Camera X9T | 0 – before 05.02.31.140 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://iknow.lenovo.com.cn/detail/442625 vendor-advisory