Which versions of Naxclow IoT Devices are affected by CVE-2026-50101?

Naxclow smart cameras and doorbells (Smart Doorbell X3, X Smart Home, V720, ix Cam) are vulnerable to persistent credential exposure that grants indefinite unauthorized access to device relay…

How to fix or mitigate CVE-2026-50101?

24 hours: Inventory all Naxclow affected models in production and assess whether relay credentials have been exposed or devices accessed by unauthorized parties. 7 days: Implement network segmentation by isolating affected devices on dedicated VLANs with firewall rules restricting relay communication; enable logging and alerts on relay channel activity. 30 days: Monitor Naxclow security advisories for patch release; if no patch materializes, evaluate decommissioning non-critical devices or implementing permanent network isolation.

Naxclow IoT Devices CVE-2026-50101

Q: What is the CVSS score of CVE-2026-50101?

CVE-2026-50101 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36526 CRITICAL

Not Using Password Aging (CWE-262)

2026-06-12 icscert

GHSA-x3mh-94rm-26c7

Information Disclosure Smart Doorbell X3 X Smart Home V720 Ix Cam

9.2

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network-reachable relay (AV:N); attacker must first acquire the non-rotatable credential (AC:H); no victim auth or interaction needed (PR:N/UI:N); full eavesdrop/impersonation impacts confidentiality and integrity, availability impact is limited.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 19:24 vuln.today

DescriptionCVE.org

Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it through any exposure path can maintain persistent access to the device’s relay channel. This enables long-term impersonation or interception, even after factory resets or re-onboarding.

AnalysisAI

Persistent credential exposure in Naxclow smart cameras and doorbells (Smart Doorbell X3, X Smart Home, V720, ix Cam) allows anyone who obtains a device's server-side relay credential to maintain indefinite access to that device's relay channel. Because the credential is re-issued unchanged on every boot and cannot be rotated, reset, or revoked by the owner, even factory resets and re-onboarding do not evict an attacker. No public exploit identified at time of analysis, and EPSS/KEV signals are not provided in the input.

Technical ContextAI

Naxclow consumer IoT devices (cameras, doorbells) communicate with users via a vendor-operated relay/cloud service rather than direct LAN connections, using a per-device credential to authenticate the device on that relay channel. CWE-262 (Not Using Password Aging) captures the root cause: the relay credential is assigned server-side, lacks any rotation or revocation lifecycle, and is re-pushed to the device at every boot, meaning the device-to-cloud trust anchor is effectively immutable for the life of the unit. CPE data (naxclow:smart_doorbell_x3, x_smart_home, v720, ix_cam - all version wildcards) confirms the flaw is in the shared backend/firmware design rather than a single model or build.

RemediationAI

No vendor-released patch identified at time of analysis - because the flaw is in how the vendor's backend issues and manages the relay credential, a true fix requires server-side credential rotation logic plus a firmware update that accepts rotated credentials, which has not been confirmed in the supplied references. Until Naxclow publishes a fix (track https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02 for updates), the only effective compensating control is to remove the devices from any sensitive deployment and isolate them on a segmented VLAN with no inbound access to monitored areas, accepting that the relay channel itself cannot be trusted; blocking the vendor relay endpoints at the perimeter kills the cloud feature (and the device's primary functionality), so users who depend on remote viewing should consider replacing affected models rather than mitigating in place. Factory reset and re-onboarding are explicitly ineffective per the description and should not be relied on.