CVE-2026-50099

4.6 MEDIUM

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed ...

Published: 2026-06-12 · Last updated: 2026-06-12

Severity and scoring

CVSS: 4.6 MEDIUM
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-538

Description

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.

Source: NVD

References

Related CVEs

Same CWE

CVE-2026-50565 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (4.9 MEDIUM)
CVE-2026-46617 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes
CVE-2026-29114 — A vulnerability has been found in some Dahua products
CVE-2019-25717 — Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain an information disclosure vulnerability that allows unauthenticated n... (4.3 MEDIUM)
CVE-2026-10254 — A flaw has been found in SourceCodester Pet Grooming Management Software 1.0 (5.3 MEDIUM)