CVE-2026-50099 describes a vulnerability in the Naxclow Smart Doorbell X3 where sensitive WiFi information (SSID, PSK, WPA keys) is printed in cleartext to an exposed UART console during WiFi association. The UART pads are labeled and use default serial settings, dropping to an interactive RT-Thread shell that permits arbitrary memory reads and full firmware extraction. This allows an attacker with brief physical access to the device to recover WiFi credentials and bootstrap further firmware attacks. The vulnerability is classified under CWE-538 (Insertion of sensitive information into externally-accessible file or directory). No patch or official remediation is currently documented.

An attacker with brief physical access to the device can obtain sensitive WiFi credentials and extract the full firmware via the exposed UART console. This compromises network security by exposing WiFi keys and enables firmware-level attacks, potentially leading to device takeover or network infiltration. The vulnerability does not require user interaction or privileges and affects production hardware commonly mounted outdoors, increasing the risk of physical access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, physical security controls to prevent unauthorized access to the device's UART interface are recommended. Disabling or securing UART access, if possible, and monitoring for firmware updates from Naxclow are advised.