CVE-2026-16754 PUBLISHED

Assigner: lenovo
Reserved: 23.07.2026 Published: 15.10.2026 Updated: 16.10.2026

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Adjacent	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	None
User Interaction	Passive

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS Score: 4.8

Attack Vector	Adjacent Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	None
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Lenovo
Product	Smart Camera C33
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Camera C33 Pro
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Camera C35
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Camera RQ3
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Camera XW1
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Network PTZ X5T
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Network PTZ X5Q
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Network PTZ X5E
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Camera X6T
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Camera X6Q
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Camera C5X
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Vendor	Lenovo
Product	Smart Camera X9T
Versions	Default: unaffected affected from 0 to 05.02.31.140 (excl.)

Solutions

Update product to latest version as indicated in the advisory - https://iknow.lenovo.com.cn/detail/442625

Credits

Lenovo thanks Tan Qingyin, Jin Chenghua, and Song Yuxin Key, Laboratory of Data and Intelligent System Security, Ministry of Education, China Nankai University finder

References

https://iknow.lenovo.com.cn/detail/442625

Problem Types

CWE-295: Improper Certificate Validation CWE