github.com
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-02.json CVE-2026-50099
MEDIUM
Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory
Record summary
CVE-2026-50099 has a selected CVSS score of 5.1 (medium).
Description
During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 12, 2026 · Source: CVE List
Affected products and versions
4| Product | Source | Version range | Status |
|---|---|---|---|
Smart Doorbell X3Browse Naxclow / Smart Doorbell X3Default status: unaffected | CVE List | All versions | affected |
Default status: unaffected | CVE List | All versions | affected |
X Smart HomeBrowse Naxclow / X Smart HomeDefault status: unaffected | CVE List | All versions | affected |
ix camBrowse Naxclow / ix camDefault status: unaffected | CVE List | All versions | affected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-50099 cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02