CVE-2026-16754
Quick assessment
Affected
Lenovo Smart Camera C33
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
据报道，专为中国市场销售的联想智能摄像头 C33 存在潜在的证书验证不当漏洞，攻击者可能借此拦截或篡改网络通信。
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16754
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Lenovo | Smart Camera C33 | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Camera C33 Pro | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Camera C35 | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Camera RQ3 | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Camera XW1 | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Network PTZ X5T | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Network PTZ X5Q | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Network PTZ X5E | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Camera X6T | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Camera X6Q | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Camera C5X | 0 ~ 05.02.31.140 | - |
|
| Lenovo | Smart Camera X9T | 0 ~ 05.02.31.140 | - |
|
II. Public POCs for CVE-2026-16754
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16754
请登录查看更多情报信息。
Other References for CVE-2026-16754 (1)
-
https://iknow.lenovo.com.cn/detail/442625 vendor-advisory
Same Patch Batch · Lenovo · 2026-10-15 · 7 CVEs total
| CVE-2026-75941 | 8.0 HIGH | 联想Legion Zone应用远程代码执行漏洞 |
| CVE-2026-92629 | 7.3 HIGH | 联想百应PC客户端越权执行任意代码漏洞 |
| CVE-2026-89057 | 6.8 MEDIUM | 联想平板电脑身份验证绕过漏洞 |
| CVE-2026-92777 | 6.4 MEDIUM | 联想平板解锁后物理访问执行代码漏洞 |
| CVE-2026-89062 | 5.5 MEDIUM | 联想能源管理驱动越界写入致蓝屏 |
| CVE-2026-16755 | 5.3 MEDIUM | 联想C33智能摄像头信息泄露漏洞 |
IV. Related Vulnerabilities
Same product: Smart Camera C33
Same weakness: CWE-295
-
CVE-2026-109383
undici vulnerable to TLS certificate validation bypass via d -
CVE-2023-32198
Steve doesn’t verify a server’s certificate and is susceptib -
CVE-2025-23390
Fleet doesn’t validate a server’s certificate when connectin -
CVE-2026-19377
Improper certificate validation in Cato Client tunnel handsh -
CVE-2026-105236
TLS 1.2 session resumption in ssl crosses SNI virtual-host c
V. Comments for CVE-2026-16754
No comments yet