What is the CVSS score of EUVD-2026-36531?

EUVD-2026-36531 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-36531?

24 hours: Conduct immediate inventory of all Naxclow devices in production; classify by criticality and physical location access. 7 days: Restrict network access to affected devices using network segmentation; disable remote management features where possible; notify end users of risks. 30 days: Monitor vendor security advisories (ICSA-26-162-02) for patch release; prepare upgrade or replacement plan; evaluate alternative IoT platforms if Naxclow patch timeline extends beyond 60 days.

Naxclow Platform EUVD-2026-36531

| CVE-2026-42947 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-12 icscert

GHSA-hrr2-8g8j-2h2h

Authentication Bypass Smart Doorbell X3 X Smart Home V720 Ix Cam Naxclow

8.7

CVSS 4.0 · Vendor: icscert

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Register free Naxclow account
Delivery

Enumerate or harvest target device ID
Exploit

Forge signed confirm-then-bind request
Execution

Replay sequence against platform API
Persist

Platform reassigns device to attacker account
Impact

Attacker gains live camera/doorbell access

Vulnerability Assessment

Weakness	CWE CWE-639 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Object-level authorization, IDOR prevention
Exploitation Conditions	Attacker needs (1) a valid Naxclow platform account (PR:L - any self-registered account qualifies) and (2) the ability to issue the platform's confirm-then-bind API call against a target device identifier with a correctly signed request body; legitimate ownership of that device is NOT required because the endpoint only validates the request signature, not the account-to-device authorization. The target device must be online (the description states the device 'remains online and unaware' during reassignment), and the affected product line is limited to Naxclow's cloud platform serving Smart Doorbell X3, X Smart Home, V720, and iX Cam. No user interaction on the victim side is required (UI:N), and no special non-default configuration is needed - the vulnerable workflow is the standard onboarding path.
Impact	CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H (base 8.7) reflects a network-reachable, low-complexity bug usable by any account holder with no victim interaction - a realistic profile for cloud IoT abuse. SSVC/EPSS/KEV data are not provided; CISA's involvement (ICSA-26-162-02) signals real-world significance for ICS/IoT defenders but does not equal confirmed active exploitation. The signature-validation-without-ownership-check pattern is highly automatable across the entire Naxclow customer base, so even without a public PoC the blast radius is large: any registered Naxclow account can be the launching point. Treat as high real-world priority for users of the listed devices, but note that exact patch status, EPSS, and exploitation telemetry are absent from the supplied intelligence and should be confirmed against the CISA advisory.
Exploit ScenarioDerived	An attacker registers a free Naxclow account, captures or replays the confirm-then-bind API sequence for a target device ID (which may be enumerated or harvested), and submits a valid-signature bind request that reassigns the doorbell or camera to their account. The victim's app silently loses the device while the camera continues streaming - now to the attacker - without the device itself indicating a re-pairing event. No public exploit identified at time of analysis, but the workflow is straightforward enough to automate at scale once one researcher publishes details.

Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 12, 2026

Device takeover in Naxclow's IoT platform (Smart Doorbell X3, X Smart Home, V720, and iX Cam) allows any authenticated attacker to silently reassign victim devices to their own account by replaying the onboarding confirm-then-bind sequence. The affected endpoints validate request signatures but never verify legitimate ownership, enabling remote hijacking without user interaction or device-side awareness. No public exploit identified at time of analysis, but the issue is reported via CISA ICS-CERT advisory ICSA-26-162-02.

RemediationAI

No vendor-released patch identified at time of analysis in the supplied intelligence; consult CISA ICSA-26-162-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02) for current vendor guidance and any fixed platform release. As the defect is server-side, end users cannot patch locally - practical compensating controls are limited: monitor the Naxclow companion app for unexpected unbind/bind notifications and immediately re-claim devices that disappear from your account, isolate Naxclow devices on a segmented VLAN with no inbound exposure (limits lateral pivot but does not stop cloud-side hijack), and consider taking high-sensitivity units (doorbells with audio/video into a residence) offline until the vendor confirms a fix. Organizations should treat any Naxclow device deployed in sensitive areas as compromisable until the CISA advisory is updated to indicate a vendor remediation.

Affected VersionsENISA

ix cam All

X Smart Home All

V720 All

Smart Doorbell X3 All

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability sits in the cloud-side onboarding/binding workflow used by Naxclow consumer IoT devices - smart doorbells (Smart Doorbell X3), cameras (V720, iX Cam), and the X Smart Home companion service. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the bind endpoint trusts a device identifier supplied in the request and authorizes the operation based on a valid request signature alone, without checking that the calling account currently owns or has been delegated rights to that device. The 'confirm-then-bind' pattern is a common IoT pairing flow where the device emits a temporary token during provisioning; here, replaying a captured or guessed confirm sequence is sufficient to transfer ownership at the platform level, because device identity (rather than account-to-device authorization) is the only thing validated.

Know when Smart Doorbell X3 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (icscert) PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 8.8 HIGH

Cloud API reachable over the internet (AV:N), requires only a low-privilege self-registered account (PR:L), no victim interaction (UI:N), and full takeover of device data and control yields C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can take over a device without user interaction while the device remains online and unaware.

Executive ViewAI

Why It Matters

Naxclow's IoT platform devices (Smart Doorbell X3, X Smart Home, V720, iX Cam) contain a critical account hijacking vulnerability that allows authenticated attackers to silently reassign victim devices to their own account without user awareness or device-side notification. Organizations operating these devices face loss of device control, physical security exposure, and potential customer trust impact, particularly if devices are customer-facing or handle security functions.

Business Impact: High

Compensating Controls

Interim mitigation strategies: isolate affected devices on dedicated network segments with egress filtering; implement IP-based access control lists restricting management access; disable device onboarding features; monitor authentication logs for unusual account access patterns; consider device replacement if devices control critical security functions; require multi-factor authentication on associated user accounts.

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Threat Intel

1 sources

Social Media

Sightings

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CISA CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat Yes

Deciding rule

Active threat signals + CRITICAL/HIGH severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.