Naxclow Firmware EUVD-2026-36538

Physical access to the device PCB is required to connect to the UART debug pads. The vulnerability is triggered during WiFi association - achieved by power-cycling the device or disrupting its network connection, both of which are trivially possible with brief physical access. No authentication to the device is required; the UART console is unauthenticated and drops directly to an interactive RT-Thread shell. No non-default configuration is needed - the debug console and labeled pads are present on all production units per the description. Exploitation is limited by the physical access requirement (AV:P per CVSS 4.0): remote or network-based triggering is not possible. The realistic physical accessibility of outdoor-mounted doorbells and cameras (Smart Doorbell X3, V720, Ix Cam) meaningfully lowers the practical barrier compared to the theoretical physical-access category, particularly in low-surveillance environments. The interactive shell memory-read capability is an additional exploitation condition that extends impact: the attacker must interact with the RT-Thread CLI post-connection, but this requires no special knowledge given default shell settings.

The CVSS 4.0 score of 5.1 reflects the physical access requirement (AV:P), which is the primary risk limiter and prevents remote or automated mass exploitation. Despite VC:H (high confidentiality impact on the vulnerable system) from full credential disclosure, the physical vector makes this impractical as an internet-scale attack. However, for the ICS/OT context flagged by ICS-CERT, outdoor-mounted smart doorbells and IP cameras (Smart Doorbell X3, V720, Ix Cam) present an elevated physical-access threat model compared to indoor enterprise hardware - brief access during installation, maintenance, or vandalism is realistic. No EPSS data was provided in the source intelligence; no KEV listing confirms this is not observed in active widespread exploitation campaigns. The RT-Thread interactive shell enabling arbitrary memory reads extends impact beyond credential theft alone: firmware extraction enables offline reverse engineering and supply-chain-style tampering. The attack complexity is genuinely low (AC:L) once physical access is achieved, requiring no authentication, no privileges, and no user interaction. Overall, while the raw CVSS score is medium, the realistic risk for outdoor-deployed units in environments with low physical security is meaningfully higher than the score implies.

An attacker targets an outdoor-mounted Naxclow Smart Doorbell X3 during a brief unobserved window - for example, during a delivery, maintenance visit, or after-hours approach. Using a USB-to-serial adapter connected to the labeled UART pads (no disassembly required if pads are edge-accessible), the attacker power-cycles the device to trigger a WiFi association event and captures the SSID, PSK, and WPA session keys printed in cleartext to the console. With the recovered PSK, the attacker authenticates to the host WiFi network and proceeds to pivot internally or conducts further firmware analysis via the RT-Thread shell to identify additional vulnerabilities. No public exploit code has been identified, but the attack requires only a $5 serial adapter and freely available terminal software.