Smart Camera X9T
Monthly
Sensitive information disclosure in Lenovo Smart Camera C33 - and the related C33 Pro, C35, RQ3, XW1, X6T, X6Q and Smart Network PTZ X5T/X5Q/X5E models - allows an attacker who is already positioned on the same adjacent network segment to read confidential data from the device without authenticating or relying on user interaction. The root cause class (CWE-1393, use of default password) points to weak or default credentials or secrets as the disclosure vector, and the CVSS v4.0 vector carries an AT:P precondition, meaning specific device state or configuration conditions must also hold, so this is not a direct internet-facing exploit. Exploitation is further limited because these cameras were distributed exclusively in the Chinese market; no public exploit code has been identified at time of analysis, and the independently assessed severity is a moderate, context-dependent risk rather than a top-tier emergency.
Improper TLS certificate validation in Lenovo Smart Camera firmware lets a network-adjacent attacker who has already established a man-in-the-middle position on the same local or Wi-Fi segment intercept the camera's network communications and read the traffic it protects. Unauthenticated attackers are sufficient (PR:N), and only the victim's ordinary camera or companion-app activity is required for capture (passive user interaction), with high confidentiality impact but no availability impact. Affected devices include the Smart Camera C33, C33 Pro, C35, RQ3, XW1, X6T, X6Q, C5X and X9T plus the Smart Network PTZ X5T, X5Q and X5E, all sold exclusively in the Chinese market, which sharply narrows the realistic target population. No public exploit identified at time of analysis and no CISA KEV listing; at CVSS 4.0 base 5.9 this is a medium-severity, low real-world priority issue rather than an urgent one, consistent with the requirement to first obtain an adjacent MITM position and with the absence of internet-facing exposure.
Sensitive information disclosure in Lenovo Smart Camera C33 - and the related C33 Pro, C35, RQ3, XW1, X6T, X6Q and Smart Network PTZ X5T/X5Q/X5E models - allows an attacker who is already positioned on the same adjacent network segment to read confidential data from the device without authenticating or relying on user interaction. The root cause class (CWE-1393, use of default password) points to weak or default credentials or secrets as the disclosure vector, and the CVSS v4.0 vector carries an AT:P precondition, meaning specific device state or configuration conditions must also hold, so this is not a direct internet-facing exploit. Exploitation is further limited because these cameras were distributed exclusively in the Chinese market; no public exploit code has been identified at time of analysis, and the independently assessed severity is a moderate, context-dependent risk rather than a top-tier emergency.
Improper TLS certificate validation in Lenovo Smart Camera firmware lets a network-adjacent attacker who has already established a man-in-the-middle position on the same local or Wi-Fi segment intercept the camera's network communications and read the traffic it protects. Unauthenticated attackers are sufficient (PR:N), and only the victim's ordinary camera or companion-app activity is required for capture (passive user interaction), with high confidentiality impact but no availability impact. Affected devices include the Smart Camera C33, C33 Pro, C35, RQ3, XW1, X6T, X6Q, C5X and X9T plus the Smart Network PTZ X5T, X5Q and X5E, all sold exclusively in the Chinese market, which sharply narrows the realistic target population. No public exploit identified at time of analysis and no CISA KEV listing; at CVSS 4.0 base 5.9 this is a medium-severity, low real-world priority issue rather than an urgent one, consistent with the requirement to first obtain an adjacent MITM position and with the absence of internet-facing exposure.