Skip to content
OpenAdvisories
Critical ICSA-26-162-02 7 CVEs

Naxclow IoT Platform

Published Jun 11, 2026 · Updated Jun 11, 2026

Vendor: Naxclow Product: ix cam Product: Smart Doorbell X3 Product: V720 Product: X Smart Home

Summary

Successful exploitation of these vulnerabilities could allow an attacker to impersonate devices, intercept or manipulate communications, harvest sensitive credentials at scale, or gain unauthorized access.

Vulnerabilities 7

  • Critical 9.8
    CVE-2026-28742

    Naxclow IoT Platform Use of hard-coded cryptographic key

    Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations …

    Naxclow ix cam Smart Doorbell X3 V720
  • High 8.8
    CVE-2026-42947

    Naxclow IoT Platform Authorization bypass through User-Controlled key

    A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate owners…

    Naxclow X Smart Home ix cam Smart Doorbell X3
  • High 8.1
    CVE-2026-50101

    Naxclow IoT Platform Not using password aging

    Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it…

    Naxclow X Smart Home ix cam Smart Doorbell X3
  • High 7.5
    CVE-2026-50108

    Naxclow IoT Platform Missing Authorization

    The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credential…

    Naxclow Smart Doorbell X3 V720 X Smart Home
  • Medium 5.3
    CVE-2026-42932

    Naxclow IoT Platform Generation of Predictable Numbers or Identifiers

    Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, th…

    Naxclow X Smart Home ix cam Smart Doorbell X3
  • Medium 5.3
    CVE-2026-50244

    Naxclow IoT Platform Missing Authorization

    The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier, without validating any ownership relationship. Each call mints a new sequential device identifier …

    Naxclow V720 X Smart Home ix cam
  • Medium 4.6
    CVE-2026-50099

    Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory

    During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interacti…

    Naxclow X Smart Home ix cam Smart Doorbell X3

Revision history

  1. #1

    Initial Publication

References