CVE-2026-50099

The record

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.

Affected packages

Related vulnerabilities

• CVE-2026-67361 Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory… CWE-538
• GHSA-9c83-rr99-vfwj MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at… CWE-538
• CVE-2026-50565 Fission is an open-source, Kubernetes-native serverless framework that simplifies the… CWE-538
• CVE-2026-46617 Fission is an open-source, Kubernetes-native serverless framework that simplifies the… CWE-538
• CVE-2026-29114 A vulnerability has been found in some Dahua products. CWE-538
• CVE-2019-25717 Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain an information… CWE-538
• CVE-2026-10254 A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. CWE-538
• CVE-2026-49298 A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to… CWE-538