CVE-2026-33268: Nanoleaf Lines

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads. A remote, unauthenticated attacker can upload firmware files on the device and consume storage resources. Fixed in 12.3.6.

Affected products

• Nanoleaf Lines: from 12.3.2, before 12.3.6 (fixed in 12.3.6)

Published 2026-03-25. Last modified 2026-06-17.