{"id":"CVE-2026-16754","kind":"vulnerability","aliases":["CVE-2026-16754"],"related":[],"title":"Lenovo Smart Camera C33: improper certificate validation lets adjacent attacker intercept traffic","description":"A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.","summary":"The Lenovo Smart Camera C33, sold only in the Chinese market, does not properly validate certificates in some network communications. An attacker on the same local network can intercept or manipulate that traffic.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","iot","lenovo","local-network","smart-camera"],"not_affected_if":["not-chinese-market-device"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T00:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:09:56+00:00","updated_at":"2026-10-25T04:09:56+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:09:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Lenovo Smart Camera C33: improper certificate validation lets adjacent attacker intercept traffic","impact":"medium","summary":"The Lenovo Smart Camera C33, sold only in the Chinese market, does not properly validate certificates in some network communications. An attacker on the same local network can intercept or manipulate that traffic.","category":"infrastructure","nicknames":[],"who_cares":["lenovo","iot","smart-camera","local-network"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Adjacent attacker intercepts or manipulates device network communications","analyst_note":"Find the Lenovo PSIRT advisory for CVE-2026-16754 to get affected firmware versions and the fixed release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-chinese-market-device"],"who_is_affected":"Owners of the Lenovo Smart Camera C33 distributed in the Chinese market are the affected population. The sources do not say which firmware versions are vulnerable or whether a patch exists. Teams without this device on their network can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000548,"input_tokens":3288,"output_tokens":439,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16754':15A,18A '-2026':14A,17A 'adjac':9A,84C 'allow':82C 'attack':10A,49B 'c33':4A,32B,73C 'camera':3A,27B,31B,72C 'certif':6A,43B,64C 'chines':37B,78C 'communic':47B,91C 'could':81C 'cve':13A,16A 'distribut':74C 'exclus':75C 'improp':5A,63C 'infrastructur':19B 'intercept':11A,56B,87C 'iot':20B 'lenovo':1A,21B,29B,70C 'let':8A 'local':23B,53B 'local-network':22B 'manipul':58B,89C 'market':38B,79C 'network':24B,46B,54B,90C 'potenti':62C 'proper':41B 'report':68C 'smart':2A,26B,30B,71C 'smart-camera':25B 'sold':33B 'traffic':12A,60B 'user':85C 'valid':7A,42B,65C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Owners of the Lenovo Smart Camera C33 distributed in the Chinese market are the affected population. The sources do not say which firmware versions are vulnerable or whether a patch exists. Teams without this device on their network can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@lenovo.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16754","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16754","severity":null,"published_at":"2026-10-16T00:17:05+00:00","modified_at":"2026-10-16T19:55:59+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}