Naxclow Smart Devices EUVD-2026-36532

No authentication is required (CVSS PR:N) and no special client configuration is needed (AC:L, AT:N). The required condition is network accessibility to the Naxclow cloud platform endpoint that exposes the identifier high-water mark - if this endpoint is internet-facing (the default deployment model for consumer IoT), exploitation is trivially accessible from anywhere. The limiting factor is that impact is confined to information disclosure (device enumeration); the CVE does not describe a path to direct device control or data exfiltration beyond ID values. Exploitation is bounded to the four confirmed product lines: Smart Doorbell X3, X Smart Home, V720, and IX Cam. Deployments where the management platform is isolated behind a VPN or private network would not be reachable by external attackers.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N reflects a remotely exploitable, zero-authentication, low-complexity information disclosure flaw with limited confidentiality impact (device identifiers, not credentials or PII directly). The VC:L rating is appropriate - the disclosed data is device IDs, which are pseudonymous but enable targeted follow-on reconnaissance. No integrity or availability impact is scored, which is consistent with the description. The real-world risk extends beyond the raw CVSS signal: in ICS/IoT contexts, fleet enumeration is a critical reconnaissance step enabling targeted physical-world attacks (e.g., identifying which doors or cameras belong to a specific site). The ICS-CERT reporting source elevates concern given the OT/IoT context. EPSS data was not provided, and no KEV listing or POC code is confirmed, so the exploitation probability cannot be independently quantified. The absence of version-specific CPE data means all deployed Naxclow devices across these four product lines should be treated as affected until the vendor clarifies patched versions.

An unauthenticated attacker sends a single HTTP request to the Naxclow platform's public identifier high-water mark endpoint to determine the current maximum device ID, then iterates sequentially through the predictable prefix+counter ID space to enumerate every active device in the fleet. The resulting device inventory reveals which physical locations have deployed Naxclow cameras and doorbells, enabling targeted follow-on attacks such as physical intrusion timing or device-specific exploitation. No public exploit code is confirmed, but the technique requires only a basic HTTP client and knowledge of the fixed prefix format.