{"id":"CVE-2026-16755","kind":"vulnerability","aliases":["CVE-2026-16755"],"related":[],"title":"Lenovo Smart Camera C33: remote user can disclose sensitive information","description":"A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.","summary":"A potential flaw in the Lenovo Smart Camera C33, sold only in the Chinese market, lets an unauthorized remote user read sensitive information. The sources do not name the exact weakness or the affected firmware versions.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","iot","lenovo","smart-camera"],"not_affected_if":["not-c33-owner"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T00:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:05:54+00:00","updated_at":"2026-10-25T04:05:54+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:05:54Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Lenovo Smart Camera C33: remote user can disclose sensitive information","impact":"low","summary":"A potential flaw in the Lenovo Smart Camera C33, sold only in the Chinese market, lets an unauthorized remote user read sensitive information. The sources do not name the exact weakness or the affected firmware versions.","category":"infrastructure","nicknames":[],"who_cares":["lenovo","smart-camera","iot"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Remote attacker reads sensitive camera information without authorization","analyst_note":"Find the Lenovo PSIRT advisory for this CVE to confirm affected firmware versions, the fixed version, and whether the flaw needs network exposure (https://nvd.nist.gov/vuln/detail/CVE-2026-16755).","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["not-c33-owner"],"who_is_affected":"Owners of the Lenovo Smart Camera C33 sold in the Chinese market are the population the advisory covers. The sources do not say which firmware versions are affected or whether the camera must be exposed to the internet to be reachable. Teams without this device can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000569,"input_tokens":3286,"output_tokens":481,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16755':13A,16A '-2026':12A,15A 'affect':56B 'allow':77C 'c33':4A,31B,68C 'camera':3A,22B,30B,67C 'chines':36B,73C 'could':76C 'cve':11A,14A 'disclos':8A,83C 'distribut':69C 'exact':52B 'exclus':70C 'firmwar':57B 'flaw':25B 'inform':10A,45B,85C 'infrastructur':17B 'iot':18B 'lenovo':1A,19B,28B,65C 'let':38B 'market':37B,74C 'name':50B 'potenti':24B,60C 'read':43B 'remot':5A,41B,80C 'report':63C 'sensit':9A,44B,84C 'smart':2A,21B,29B,66C 'smart-camera':20B 'sold':32B 'sourc':47B 'unauthor':40B,79C 'user':6A,42B,81C 'version':58B 'vulner':61C 'weak':53B","nicknames":[],"mitigations":[],"who_affected":"Owners of the Lenovo Smart Camera C33 sold in the Chinese market are the population the advisory covers. The sources do not say which firmware versions are affected or whether the camera must be exposed to the internet to be reachable. Teams without this device can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@lenovo.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16755","severity":null,"published_at":"2026-10-16T00:17:05+00:00","modified_at":"2026-10-16T19:55:59+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}