{"id":79681,"date":"2026-06-12T21:54:14","date_gmt":"2026-06-12T18:24:14","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2026-50099-naxclow-iot-platform-insertion-of-sensitive-information-into-externally-accessible-file-or-directory\/"},"modified":"2026-06-12T21:54:14","modified_gmt":"2026-06-12T18:24:14","slug":"cve-2026-50099-naxclow-iot-platform-insertion-of-sensitive-information-into-externally-accessible-file-or-directory","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2026-50099-naxclow-iot-platform-insertion-of-sensitive-information-into-externally-accessible-file-or-directory\/","title":{"rendered":"CVE-2026-50099 &#8211; Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory"},"content":{"rendered":"<p>CVE ID :CVE-2026-50099<\/p>\n<p>  Published : June 12, 2026, 6:24 p.m. | 59\u00a0minutes ago<\/p>\n<p>  Description :During WiFi association, Naxclow device firmware prints the host network\u2019s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.<\/p>\n<p>  Severity: 5.1 | MEDIUM<\/p>\n<p>  Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID :CVE-2026-50099 Published : June 12, 2026, 6:24 p.m. | 59\u00a0minutes ago Description :During WiFi association, Naxclow device firmware prints the host network\u2019s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-79681","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/79681","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=79681"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/79681\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=79681"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=79681"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=79681"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}