Read the docs
TI-2026-75105 Aliases CVE-2026-16754

Improper certificate validation in Lenovo Smart Camera C33

Priority LOW 25CWE-295Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

A potential improper certificate validation flaw (CWE-295) affects Lenovo Smart Camera C33, Smart Camera C33 Pro, Smart Camera C35, Smart Camera RQ3, Smart Camera XW1 and other products from 0 before 05.02.31.140, distributed exclusively in the Chinese market. An adjacent user could intercept or manipulate network communications.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00074 0th percentileScored 2026-11-07
Fix Fixed Smart Camera C33 (Lenovo): 05.02.31.140Smart Camera C33 Pro (Lenovo): 05.02.31.140+10 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoSmart Camera C33before 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Camera C33 Probefore 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Camera C35before 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Camera RQ3before 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Camera XW1before 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Network PTZ X5Tbefore 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Network PTZ X5Qbefore 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Network PTZ X5Ebefore 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Camera X6Tbefore 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Camera X6Qbefore 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Camera C5Xbefore 05.02.31.14005.02.31.140Patch availableCNA
LenovoSmart Camera X9Tbefore 05.02.31.14005.02.31.140Patch availableCNA
  • Smart Camera C33 VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Camera C33 Pro VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Camera C35 VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Camera RQ3 VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Camera XW1 VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Network PTZ X5T VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Network PTZ X5Q VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Network PTZ X5E VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Camera X6T VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Camera X6Q VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Camera C5X VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA
  • Smart Camera X9T VendorLenovo Affected before 05.02.31.140 Fixed in 05.02.31.140 Patch available CNA

Remediation

Lenovo lists version 05.02.31.140 as the fixed version for Smart Camera C33, Smart Camera C33 Pro, Smart Camera C35, Smart Camera RQ3, Smart Camera XW1 and other affected products.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Smart Camera C33 (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Camera C33 Pro (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Camera C35 (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Camera RQ3 (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Camera XW1 (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Network PTZ X5T (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Network PTZ X5Q (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Network PTZ X5E (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Camera X6T (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Camera X6Q (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Camera C5X (Lenovo) Fixed in 05.02.31.140
  • Fix · CNA Smart Camera X9T (Lenovo) Fixed in 05.02.31.140

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Lenovo Smart Camera C33, Smart Camera C33 Pro and 10 more products — iknow.lenovo.com.cn/detail/442625

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-75106 Default password in Lenovo Smart Camera C33 enables data disclosurePriority LOW 26
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-16754
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07516 Insecure Platform Key (PK) used in UEFI system firmware signature CVSS 3.1MEDIUM 6.4
  • TI-2017-13070 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory… CVSS 3.0CRITICAL 9.8
  • TI-2017-02875 OS command injection in Lenovo Service Framework application CVSS 3.0CRITICAL 9.8
  • TI-2013-01192 Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate… CVSS 2.0HIGH 9.3
  • TI-2026-53163 Hard-coded credentials in Lenovo Health Application CVSS 4.0CRITICAL 9.3
See all 534 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences