Which versions of Naxclow Devices are affected by CVE-2026-28742?

Naxclow smart home devices (Smart Doorbell X3, X Smart Home, V720, Ix Cam) contain a critical authentication bypass due to a hard-coded cryptographic salt identical across the entire product line,…

How to fix or mitigate CVE-2026-28742?

Within 24 hours: Inventory all Naxclow devices deployed; isolate them to a segmented network with no external routing; audit recent API logs for unauthorized requests. Within 7 days: Disable remote access to affected devices or place behind VPN/firewall controls; implement packet monitoring for anomalous API traffic patterns. Within 30 days: Develop vendor replacement roadmap prioritizing smart home systems with per-device key material and firmware-level rotation mechanisms; establish procurement policy excluding products with shared cryptographic secrets.

Naxclow Devices CVE-2026-28742

Q: What is the CVSS score of CVE-2026-28742?

CVE-2026-28742 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36525 CRITICAL

Use of Hard-coded Cryptographic Key (CWE-321)

2026-06-12 icscert

GHSA-j3pq-62hg-9x25

RCE Smart Doorbell X3 X Smart Home V720 Ix Cam

9.2

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable cloud API with no auth or user interaction, but AC:H reflects the one-time salt-recovery prerequisite captured as AT:P in 4.0; full CIA impact on devices and accounts.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 19:25 vuln.today

DescriptionCVE.org

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.

AnalysisAI

Cryptographic authentication bypass in Naxclow smart home devices (Smart Doorbell X3, X Smart Home, V720, Ix Cam) allows remote attackers to forge arbitrary device and account API requests after extracting a single hard-coded salt shared across the entire product line. Because the same salt is embedded in every firmware image and no per-device keys, nonces, or replay protections exist, recovery from one unit compromises the whole fleet, and plain-HTTP control traffic makes interception trivial. No public exploit identified at time of analysis, and the issue was disclosed via CISA ICS-CERT advisory ICSA-26-162-02.

Technical ContextAI

The vulnerability is a textbook CWE-321 (Use of Hard-coded Cryptographic Key) issue applied to a request-signing scheme. Naxclow's mobile-to-cloud and cloud-to-device control protocol signs API calls using HMAC-style signatures derived from a salt that is identical across every shipped firmware image, with no derivation step that mixes in a device-unique secret. Compounding this, the server does not track nonces or timestamps to prevent replay, and the control plane runs over cleartext HTTP rather than TLS - meaning even without reversing firmware, an on-path attacker can capture and replay or modify signed requests. Affected CPEs cover four product lines (cpe:2.3:a:naxclow:smart_doorbell_x3, x_smart_home, v720, ix_cam), all consumer IoT camera/doorbell devices typically deployed on home networks but managed through an internet-facing cloud backend.

RemediationAI

No vendor-released patch identified at time of analysis in the provided input; consult the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02 for the current vendor position, since a proper fix requires firmware changes that introduce per-device key provisioning, server-side nonce or timestamp validation, and migration of the control plane from HTTP to TLS. Until the vendor ships updated firmware, the most effective compensating control is network isolation - place affected devices on a segmented VLAN with no inbound internet exposure and block outbound traffic except to the vendor cloud endpoints, accepting the trade-off that remote app features may break if the vendor backend is also blocked. Where the cloud app is not strictly required, disconnect devices from the internet entirely and rely on local-network access only; if continued cloud use is mandatory, monitor for anomalous device-control traffic and consider replacing the affected models given that the underlying design defect cannot be mitigated at the network layer.