{"id":"CVE-2026-50099","state":"PUBLISHED","title":"Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory","description":"During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.","publishedAt":"2026-06-12T18:24:14.760Z","updatedAt":"2026-06-12T18:58:23.718Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Naxclow Smart Doorbell X3","Naxclow X Smart Home","Naxclow V720","Naxclow ix cam"],"affected":[{"vendor":"Naxclow","product":"Smart Doorbell X3","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"Naxclow","product":"X Smart Home","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"Naxclow","product":"V720","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"Naxclow","product":"ix cam","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-02.json"],"weaknesses":["CWE-538"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/50xxx/CVE-2026-50099.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-50099","state":"PUBLISHED","datePublished":"2026-06-12T18:24:14.760Z","dateUpdated":"2026-06-12T18:58:23.718Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2026-06-08T20:04:55.558Z"},"containers":{"cna":{"title":"Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory","descriptions":[{"lang":"en","value":"During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks."}],"affected":[{"vendor":"Naxclow","product":"Smart Doorbell X3","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"Naxclow","product":"X Smart Home","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"Naxclow","product":"V720","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]},{"vendor":"Naxclow","product":"ix cam","defaultStatus":"unaffected","versions":[{"version":"All","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-02.json"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.1,"vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4.6,"vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-538","lang":"en","description":"CWE-538 Insertion of sensitive information into Externally-Accessible file or directory","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-06-12T18:24:14.760Z"},"datePublic":"2026-06-11T15:52:00.000Z","workarounds":[{"lang":"en","value":"Naxclow did not respond to CISA's attempts to coordinate these \nvulnerabilities. Users should contact Naxclow for more information.","supportingMedia":[{"type":"text/html","base64":false,"value":"Naxclow did not respond to CISA's attempts to coordinate these \nvulnerabilities. Users should contact Naxclow for more information."}]}],"credits":[{"lang":"en","value":"Temuri Takalandze reported this vulnerability to CISA.","type":"finder"}],"source":{"advisory":"ICSA-26-162-02","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-12T18:58:18.400404Z","id":"CVE-2026-50099","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-12T18:58:23.718Z"}}]}}}