---
id: "CVE-2026-16754"
kind: "vulnerability"
aliases: ["CVE-2026-16754"]
title: "Lenovo Smart Camera C33: improper certificate validation lets adjacent attacker intercept traffic"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "iot", "lenovo", "local-network", "smart-camera"]
not_affected_if: ["not-chinese-market-device"]
published_at: "2026-10-16T00:17:05+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:09:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16754", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Lenovo Smart Camera C33: improper certificate validation lets adjacent attacker intercept traffic

The Lenovo Smart Camera C33, sold only in the Chinese market, does not properly validate certificates in some network communications. An attacker on the same local network can intercept or manipulate that traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16754

## From the sources

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_