Naxclow Platform EUVD-2026-36533

Q: What is the CVSS score of EUVD-2026-36533?

EUVD-2026-36533 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-50244 MEDIUM

Missing Authorization (CWE-862)

2026-06-12 icscert

GHSA-xw3c-vh4p-m7j2

Authentication Bypass Smart Doorbell X3 X Smart Home V720 Ix Cam

6.9

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint requiring no privileges; sole impact is low confidentiality disclosure of fleet counter values with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 19:28 vuln.today

DescriptionCVE.org

The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier, without validating any ownership relationship. Each call mints a new sequential device identifier and returns the current high-water counter value for the batch, allowing callers to measure and enumerate the active device space. The endpoint’s behavior enables precise fleet enumeration.

AnalysisAI

Fleet enumeration in the Naxclow smart home platform (Smart Doorbell X3, X Smart Home, V720, Ix Cam) allows unauthenticated remote callers to precisely map active device populations by exploiting a registration endpoint that allocates sequential device identifiers without validating caller ownership of the supplied account identifier. Each API call returns a high-water batch counter that directly reveals fleet size, making reconnaissance deterministic and low-noise rather than a side-channel inference. No public exploit code has been identified at time of analysis, but the zero-privilege, network-accessible attack surface and ICS-CERT reporting context (ICSA-26-162-02) indicate meaningful real-world exposure for residential and small-business physical security deployments.

Technical ContextAI

The four affected products - Naxclow Smart Doorbell X3 (cpe:2.3:a:naxclow:smart_doorbell_x3:*), X Smart Home (cpe:2.3:a:naxclow:x_smart_home:*), V720 (cpe:2.3:a:naxclow:v720:*), and Ix Cam (cpe:2.3:a:naxclow:ix_cam:*) - share a common cloud registration backend. The root cause is CWE-862 (Missing Authorization): the registration endpoint accepts signed API requests bundling a vendor-defined batch prefix with a caller-controlled account identifier, but performs no server-side check confirming the requester holds any ownership or authorization claim over that identifier. Because the platform mints a new sequential device ID with every invocation and explicitly returns the batch high-water counter, the enumeration signal is an intentional API response field rather than a timing or error side-channel. This makes exploitation both precise and stable across repeated calls.

RemediationAI

No specific patched firmware version was confirmed in the available intelligence data; the CISA ICS advisory ICSA-26-162-02 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02 and its companion CSAF document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-02.json are the authoritative sources for vendor-supplied fixes and should be monitored for patch availability. Until a confirmed patched firmware is deployed, operators should implement server-side ownership validation on the registration endpoint so that the supplied account identifier is cryptographically bound to an authenticated session or device certificate before a new device ID is allocated. Additionally, enforce strict rate limiting and automated anomaly detection on the registration API to detect and alert on rapid sequential call patterns from a single source; note that rate limiting slows enumeration but does not eliminate the authorization gap. Restricting network exposure of the registration API to known IP ranges or routing it through an API gateway that enforces caller identity provides a stronger compensating control, though it may impact legitimate device provisioning workflows and requires coordination with vendor cloud infrastructure.