Which versions of Naxclow Platform are affected by CVE-2026-50108?

The Naxclow IoT platform contains a high-severity vulnerability (CVE-2026-50108) affecting Smart Doorbell X3, X Smart Home, V720, and Ix Cam devices that allows attackers to steal device credentials…

How to fix or mitigate CVE-2026-50108?

24 hours: Inventory all Naxclow Smart Doorbell X3, X Smart Home, V720, and Ix Cam devices in production; review API access logs for unauthorized credential retrieval requests; identify business-critical deployments. 7 days: Implement network segmentation isolating IoT devices from general infrastructure; enforce least-privilege API access controls; contact Naxclow vendor for security guidance and patch timeline. 30 days: Rotate all relay-registration credentials; establish patch deployment procedures; evaluate alternative IoT vendors if patch becomes available beyond 30-day window.

Naxclow Platform CVE-2026-50108

Q: What is the CVSS score of CVE-2026-50108?

CVE-2026-50108 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36529 HIGH

Missing Authorization (CWE-862)

2026-06-12 icscert

GHSA-6rwx-723r-8rw3

Authentication Bypass Smart Doorbell X3 X Smart Home V720 Ix Cam

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Remote and unauthenticated at the platform layer (AV:N/PR:N), but AC:H because the attacker must first recover the platform request-signing scheme; scope changes to the victim device's traffic (S:C) with high confidentiality and partial integrity/availability via impersonation.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 19:23 vuln.today

DescriptionCVE.org

The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and register on the relay as that device, enabling interception and disruption of its communications.

AnalysisAI

Unauthorized credential disclosure in the Naxclow IoT platform API (affecting Smart Doorbell X3, X Smart Home, V720, and Ix Cam) allows any actor who can produce a platform-valid request signature to retrieve the persistent relay-registration credentials of arbitrary devices. Reported via CISA ICS-CERT (ICSA-26-162-02), the flaw enables an attacker to impersonate a victim device on the relay and intercept or disrupt its traffic; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is a CWE-862 Missing Authorization in the Naxclow cloud platform's device-management API. The endpoint that returns relay registration details (used so a device can connect to the manufacturer's communications relay for video/audio/control traffic) trusts that any caller bearing a valid platform request signature is entitled to any device's credentials, rather than tying the response to the authenticated identity or device ownership context. Because relay credentials are persistent (not rotated per session), a single unauthorized retrieval yields a long-lived impersonation primitive. The CPE list shows the same backend is shared across multiple Naxclow consumer IoT lines - smart doorbell, smart-home hub, and IP cameras (V720, Ix Cam) - meaning the authorization gap is a server-side platform defect, not per-firmware.

RemediationAI

No vendor-released patch identified at time of analysis in the supplied data; the CISA ICS-CERT advisory ICSA-26-162-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02) is the authoritative tracking source and should be checked for the current vendor response. Because the defect is server-side in Naxclow's relay API, end users cannot patch it directly - pragmatic compensating controls are to isolate the affected doorbell/camera/hub on a segmented VLAN with no access to sensitive internal hosts, block outbound traffic from the device except to the Naxclow relay endpoints (accepting loss of remote access if relay is blocked entirely), and avoid relying on these devices for security-critical monitoring until the vendor confirms a fix, since an attacker impersonating the device on the relay can serve substitute audio/video to the legitimate owner's app or simply deny service.