CVE-2026-50099

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-538

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-50105.1A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaSCVE-2026-501008.5Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If thiCVE-2026-501018.1Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this CVE-2026-501036.5A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing appCVE-2026-501054.3RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)CVE-2026-501066.5When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' forCVE-2026-501078.1When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINCVE-2026-501087.5The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requesterCVE-2026-50116.3A vulnerability was detected in elecV2 elecV2P up to 3.8.3. This vulnerability affects the function runJSFile of the file /webhook of the coCVE-2026-501109.2Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While tCVE-2026-501128.8SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file cCVE-2026-50127.3A flaw has been found in elecV2 elecV2P up to 3.8.3. This issue affects the function pm2run of the file /rpc. Executing a manipulation can l