Lenovo Smart Camera CVE-2026-16755

Exploitation requires the attacker to be on the same adjacent network segment as the camera (AV:A) - e.g., connected to the same Wi-Fi/LAN as the device - not arbitrary internet-based access, despite the description's 'remote user' phrasing. The AT:P metric indicates additional attack requirements must hold (a specific device state, timing, or configuration), and the CWE-1393 classification points to weak or default credentials/secrets being the disclosure vector. Limiting factors that reduce real-world risk: the need for local network adjacency, the AT:P preconditions, and the exclusively-Chinese-market distribution of the affected cameras, which constrains the exposed population. No authentication or user interaction is required once adjacency and the attack requirements are satisfied (PR:N/UI:N).

This is a moderate, context-dependent risk rather than a top-tier emergency. The vendor-assigned CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) yields a base score of 6.0 and describes an unauthenticated information-disclosure flaw whose confidentiality impact is High but whose integrity and availability impact is None. Critically, the vector specifies AV:A (Adjacent), meaning the attacker must be on the same logical network segment (e.g., the local LAN/Wi-Fi), and AT:P, meaning specific attack requirements/conditions must be present - both materially limit real-world exploitability despite PR:N/UI:N. There is a notable conflict to verify: the prose description calls this an 'unauthorized remote user,' while the CVSS vector encodes Adjacent (not Network) access - these are not equivalent, and defenders should treat this as an adjacent-network issue unless the vendor clarifies otherwise. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or widespread exploitation. The CWE-1393 classification (weak/default credentials class) combined with High confidentiality impact suggests the disclosure likely stems from predictable or default secrets rather than a complex memory-corruption bug. Overall: a real but bounded issue, prioritized by exposure (adjacent access to affected cameras) rather than by broad internet-wide risk.

An attacker who has gained a foothold on the same local network as a vulnerable Lenovo Smart Camera (for example, by joining the home or office Wi-Fi) interacts with the device over the adjacent network and, under the required conditions, retrieves sensitive information such as configuration data, credentials, or video/stream metadata without authenticating. Because the CVSS vector is AV:A/AC:L/PR:N/UI:N, no credentials or user interaction are needed once adjacency and the attack prerequisites are met. No public proof-of-concept exploit code was identified in the provided intelligence.