Naxclow Platform EUVD-2026-36529

Exploitation requires (1) the ability to produce a platform-valid request signature for Naxclow's API - meaning the attacker has reverse-engineered the official mobile app or firmware to recover the signing scheme/key - and (2) knowledge of the target device's identifier on the platform. No platform-level user authentication or ownership proof is needed, no user interaction is required, and the attack works remotely over the internet against any device registered to the Naxclow cloud. The condition that limits this to motivated actors rather than opportunistic mass exploitation is recovery of the signing material; once that is published or leaked, the limit collapses.

Signals are mixed but lean toward a real priority for affected device owners. CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N rates it 8.7 (High) with confidentiality-only impact (VC:H, VI:N, VA:N), which understates the practical follow-on impact since stolen relay credentials enable interception and disruption - effects the CVSS scope does not capture. The flaw is reported by CISA ICS-CERT, indicating coordinated disclosure for OT/IoT, but it is not listed in CISA KEV and no EPSS score was provided in the input, so widespread automated exploitation is not yet established. The hard prerequisite - producing a platform-valid request signature - limits exploitation to actors who have reverse-engineered the Naxclow app's signing scheme or recovered the signing key from firmware; this is achievable for a motivated researcher but is not the trivial unauthenticated HTTP request the CVSS PR:N field implies in isolation.

An attacker who has reverse-engineered the Naxclow mobile app or firmware to obtain its request-signing material crafts a platform-valid API call to the relay-registration endpoint, supplying the victim's device identifier (often guessable, enumerable, or harvestable from app metadata). The platform returns the device's persistent relay credentials; the attacker connects to the relay impersonating the victim's doorbell or camera, at which point they can intercept the live feed, suppress alerts, or feed spoofed content to the owner's app.