Medium severity · published Oct 15, 2026
CVE-2026-16754
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user…
4.8
CVSS
0.1%
EPSS
No
On KEV
Description
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 0% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Smart Camera C33 · Lenovo
before 05.02.31.140 · source: vendor
SC
Smart Camera C33 Pro · Lenovo
before 05.02.31.140 · source: vendor
SC
Smart Camera C35 · Lenovo
before 05.02.31.140 · source: vendor
SC
Smart Camera C5X · Lenovo
before 05.02.31.140 · source: vendor
SC
Smart Camera RQ3 · Lenovo
before 05.02.31.140 · source: vendor
SC
Smart Camera X6Q · Lenovo
before 05.02.31.140 · source: vendor
SC
Smart Camera X6T · Lenovo
before 05.02.31.140 · source: vendor
SC
Smart Camera X9T · Lenovo
before 05.02.31.140 · source: vendor
SC
Smart Camera XW1 · Lenovo
before 05.02.31.140 · source: vendor
SN
Smart Network PTZ X5E · Lenovo
before 05.02.31.140 · source: vendor
SN
Smart Network PTZ X5Q · Lenovo
before 05.02.31.140 · source: vendor
SN
Smart Network PTZ X5T · Lenovo
before 05.02.31.140 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16754
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16754
iknow.lenovo.com.cn
https://iknow.lenovo.com.cn/detail/442625
More from Smart Camera C33
5.3
CVE-2026-16755
A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose…