EUVD-2026-36532
GHSA-x87p-mc42-f63g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint; no scope change since only device IDs are disclosed; integrity and availability are unaffected.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated.
AnalysisAI
Device identifier enumeration across Naxclow's IoT product line - including the Smart Doorbell X3, X Smart Home platform, V720, and IX Cam - allows unauthenticated remote attackers to build a complete inventory of active devices deployed in the field. The identifier scheme combines fixed manufacturing prefixes with sequential counters (CWE-340), and the platform compounds this by exposing an endpoint that reveals the current identifier high-water mark, effectively handing attackers a starting point for a full sweep. Reported by ICS-CERT under ICSA-26-162-02, this is a platform-wide architectural flaw; no public exploit or KEV listing is confirmed at time of analysis, but the low complexity and zero-authentication barrier make opportunistic enumeration trivially achievable.
Technical ContextAI
CWE-340 (Generation of Predictable Numbers or Identifiers) describes a root cause where identifiers are constructed from non-random components, making the full space mathematically enumerable without brute force. In this case, Naxclow devices use a fixed manufacturer-assigned prefix combined with a sequential counter - a common but insecure pattern in embedded/IoT manufacturing where simplicity is prioritized over security. The critical amplifier here is a platform-side API endpoint that leaks the current high-water mark (the highest identifier issued so far), eliminating any remaining uncertainty about where to begin enumeration. Affected products confirmed via CPE data include: cpe:2.3:a:naxclow:smart_doorbell_x3:*, cpe:2.3:a:naxclow:x_smart_home:*, cpe:2.3:a:naxclow:v720:*, and cpe:2.3:a:naxclow:ix_cam:*. The vulnerability exists at the platform/cloud layer (the application tier), not purely at the device firmware level, meaning the fix must address both the identifier generation algorithm and the disclosure endpoint.
RemediationAI
No vendor-released patch version has been identified at time of analysis; the CPE entries carry wildcard version ranges and no fixed-version advisory was referenced. Defenders should consult the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02 for vendor guidance as it becomes available. In the interim, the most impactful compensating control is to restrict or disable the identifier high-water mark disclosure endpoint at the network or application firewall layer - eliminating this endpoint removes the primary amplifier that makes bulk enumeration practical and forces attackers back to blind sequential scanning. Additionally, if the Naxclow cloud management interface is internet-facing, placing it behind a VPN or access-controlled reverse proxy removes the network-layer accessibility that makes unauthenticated enumeration possible; the trade-off is reduced remote management convenience. Defenders operating these devices in sensitive environments (residential security, industrial sites) should monitor API access logs for sequential or high-volume identifier query patterns as a detection control.
More in Smart Doorbell X3
View allPersistent credential exposure in Naxclow smart cameras and doorbells (Smart Doorbell X3, X Smart Home, V720, ix Cam) al
Cryptographic authentication bypass in Naxclow smart home devices (Smart Doorbell X3, X Smart Home, V720, Ix Cam) allows
Device takeover in Naxclow's IoT platform (Smart Doorbell X3, X Smart Home, V720, and iX Cam) allows any authenticated a
Unauthorized credential disclosure in the Naxclow IoT platform API (affecting Smart Doorbell X3, X Smart Home, V720, and
Fleet enumeration in the Naxclow smart home platform (Smart Doorbell X3, X Smart Home, V720, Ix Cam) allows unauthentica
WiFi credential exposure in Naxclow IoT device firmware (Smart Doorbell X3, X Smart Home, V720, Ix Cam) allows any attac
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today