CVE-2026-50099

Deferred Deferred - Pending Action

WiFi Credential Leak in Naxclow Firmware via UART Console

Publication date: 2026-06-12

Last updated on: 2026-06-16

Assigner: ICS-CERT

Description

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-16

Generated

2026-07-03

AI Q&A

2026-06-12

EPSS Evaluated

2026-07-01

NVD

CVE-2026-50099

EUVD

EUVD-2026-36538

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-538	The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in Naxclow device firmware during WiFi association, where the device prints sensitive information such as the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware.

The UART pads are labeled, use default serial settings, and provide access to an interactive RT-Thread shell that allows arbitrary memory reads, enabling full firmware extraction.

An attacker with brief physical access to the device, which is common for outdoor-mounted devices, can recover WiFi credentials and launch firmware-side attacks.

Impact Analysis

This vulnerability can lead to unauthorized recovery of WiFi credentials, including SSID, PSK, and WPA keys, by an attacker with physical access to the device.

With these credentials, an attacker can gain unauthorized network access and perform firmware extraction, potentially enabling further attacks on the device or network.

Hi! I’m here to help you understand CVE-2026-50099. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70