Naxclow Devices CVE-2026-28742

Exploitation requires one-time recovery of the hard-coded request-signing salt from a Naxclow firmware image (any of Smart Doorbell X3, X Smart Home, V720, or Ix Cam - the salt is shared platform-wide), reflected in the CVSS 4.0 AT:P metric. After that, no authentication, user interaction, or special configuration is needed (PR:N, UI:N) - the attacker only needs network reachability to the Naxclow cloud control-plane endpoints, which use plain HTTP and lack nonce or timestamp validation, enabling forgery and replay against any device or account on the platform. The practical limit on exploitation is therefore the salt-extraction step and access to the vendor's cloud API, not per-victim conditions.

Real-world risk is high but gated by one prerequisite. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.2) correctly encodes that exploitation is network-reachable and unauthenticated, but Attack Requirements are Present (AT:P) - reflecting the need to first extract the salt from a firmware image. Once that one-time research step is done, exploitation becomes trivial and scalable against every device on the platform, which is the typical pattern for hard-coded-key flaws and why CWE-321 historically draws follow-on automated abuse. No KEV listing and no published POC at time of analysis, and no EPSS score was provided in the input, so quantitative exploitation likelihood cannot be cited. The ICS-CERT origin (icscert) and CISA ICS advisory indicate vendor and government coordination, but no patch data was supplied, so defenders should treat this as unpatched until the vendor advisory confirms otherwise.

An attacker buys one Naxclow device, dumps the firmware, and recovers the platform-wide salt. They then craft signed HTTP requests to the Naxclow cloud API impersonating any victim device or account - unlocking the doorbell, pulling camera streams, or rebinding the device to an attacker-controlled account - and because the control plane is plain HTTP with no replay protection, the same forged requests work against every customer on the platform.