Which versions of Naxclow Platform are affected by EUVD-2026-36531?

Naxclow's IoT platform devices (Smart Doorbell X3, X Smart Home, V720, iX Cam) contain a critical account hijacking vulnerability that allows authenticated attackers to silently reassign victim…

How to fix or mitigate EUVD-2026-36531?

24 hours: Conduct immediate inventory of all Naxclow devices in production; classify by criticality and physical location access. 7 days: Restrict network access to affected devices using network segmentation; disable remote management features where possible; notify end users of risks. 30 days: Monitor vendor security advisories (ICSA-26-162-02) for patch release; prepare upgrade or replacement plan; evaluate alternative IoT platforms if Naxclow patch timeline extends beyond 60 days.

Naxclow Platform EUVD-2026-36531

Q: What is the CVSS score of EUVD-2026-36531?

EUVD-2026-36531 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-42947 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-12 icscert

GHSA-hrr2-8g8j-2h2h

Authentication Bypass Smart Doorbell X3 X Smart Home V720 Ix Cam

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Cloud API reachable over the internet (AV:N), requires only a low-privilege self-registered account (PR:L), no victim interaction (UI:N), and full takeover of device data and control yields C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 19:24 vuln.today

DescriptionCVE.org

A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can take over a device without user interaction while the device remains online and unaware.

AnalysisAI

Device takeover in Naxclow's IoT platform (Smart Doorbell X3, X Smart Home, V720, and iX Cam) allows any authenticated attacker to silently reassign victim devices to their own account by replaying the onboarding confirm-then-bind sequence. The affected endpoints validate request signatures but never verify legitimate ownership, enabling remote hijacking without user interaction or device-side awareness. No public exploit identified at time of analysis, but the issue is reported via CISA ICS-CERT advisory ICSA-26-162-02.

Technical ContextAI

The vulnerability sits in the cloud-side onboarding/binding workflow used by Naxclow consumer IoT devices - smart doorbells (Smart Doorbell X3), cameras (V720, iX Cam), and the X Smart Home companion service. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the bind endpoint trusts a device identifier supplied in the request and authorizes the operation based on a valid request signature alone, without checking that the calling account currently owns or has been delegated rights to that device. The 'confirm-then-bind' pattern is a common IoT pairing flow where the device emits a temporary token during provisioning; here, replaying a captured or guessed confirm sequence is sufficient to transfer ownership at the platform level, because device identity (rather than account-to-device authorization) is the only thing validated.

RemediationAI

No vendor-released patch identified at time of analysis in the supplied intelligence; consult CISA ICSA-26-162-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02) for current vendor guidance and any fixed platform release. As the defect is server-side, end users cannot patch locally - practical compensating controls are limited: monitor the Naxclow companion app for unexpected unbind/bind notifications and immediately re-claim devices that disappear from your account, isolate Naxclow devices on a segmented VLAN with no inbound exposure (limits lateral pivot but does not stop cloud-side hijack), and consider taking high-sensitivity units (doorbells with audio/video into a residence) offline until the vendor confirms a fix. Organizations should treat any Naxclow device deployed in sensitive areas as compromisable until the CISA advisory is updated to indicate a vendor remediation.