A data flow vulnerability has been identified that could enable an unauthorized remote user to view sensitive information on Lenovo Smart Camera and Smart Network PTZ devices. The flaw is classified as CWE-1393, which indicates that confidential data may be exposed without proper access controls. The vulnerability may allow an attacker to obtain configuration details, captured footage, or other data stored on the device.

The vulnerability applies to a range of Lenovo Smart Camera models - C33, C33 Pro, C35, C5X, RQ3, X6Q, X6T, X9T, XW1 – as well as Smart Network PTZ models X5E, X5Q, X5T. No specific affected firmware or hardware revisions were listed, so any device running the current firmware in the Chinese market should be considered at risk until officially upgraded.

The CVSS score of 6 indicates a medium severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers likely need network access to the camera’s management interface, and the exploit path involves triggering the data flow flaw to leak information. Consequently, devices exposed to public or untrusted networks could be compromised, leading to confidentiality loss.