PatchSiren cyber security CVE debrief
CVE-2026-50099 Naxclow CVE debrief
CVE-2026-50099 is a medium-severity vulnerability (CVSS Score: 5.1) affecting Naxclow device firmware. During WiFi association, the firmware prints the host network's SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.
- Vendor
- Naxclow
- Product
- Smart Doorbell X3
- CVSS
- MEDIUM 5.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-12
- Original CVE updated
- 2026-06-12
- Advisory published
- 2026-06-12
- Advisory updated
- 2026-06-12
Who should care
Organizations using Naxclow devices, especially those mounted outdoors, should be aware of this vulnerability. The vulnerability allows an attacker with physical access to recover WiFi credentials, potentially leading to further attacks.
Technical summary
The vulnerability is caused by the device firmware printing sensitive information (SSID, PSK, and WPA keys) to an exposed UART console during WiFi association. The UART console provides an interactive RT-Thread shell, allowing arbitrary memory reads and full firmware extraction.
Defensive priority
medium
Recommended defensive actions
- Limit physical access to Naxclow devices, especially those mounted outdoors.
- Implement secure boot mechanisms to prevent unauthorized firmware modifications.
- Use secure communication protocols to protect WiFi credentials.
- Regularly update and patch device firmware to prevent exploitation.
Evidence notes
The CVE record (resourceLinkAnnotations: cve-org) and NVD detail (resourceLinkAnnotations: nvd) provide official information about the vulnerability. Additional information can be found in the source references (resourceLinkAnnotations: ref-4, ref-5).
Official resources
CVE-2026-50099 was published on 2026-06-12T19:16:29.330Z and has not been modified since then.