Skip to main content

Naxclow Firmware EUVDEUVD-2026-36538

| CVE-2026-50099 MEDIUM
Insertion of Sensitive Information into Externally-Accessible File (CWE-538)
2026-06-12 icscert GHSA-ccf8-539p-4gc2
Information Disclosure Smart Doorbell X3 X Smart Home V720 Ix Cam
5.1
CVSS 4.0 · Vendor: icscert
Share

Severity by source

Vendor (icscert) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.6 MEDIUM

Physical vector required for UART access; no privileges needed for unauthenticated console; confidentiality-only impact from credential and key disclosure with no integrity or availability effect.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 12, 2026 - 19:29 vuln.today

DescriptionCVE.org

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.

AnalysisAI

WiFi credential exposure in Naxclow IoT device firmware (Smart Doorbell X3, X Smart Home, V720, Ix Cam) allows any attacker with brief physical access to recover host network SSID, PSK, and negotiated WPA keys printed in cleartext to a labeled, production-accessible UART debug console. The UART interface drops to an unauthenticated interactive RT-Thread shell, enabling arbitrary memory reads and full firmware extraction - escalating a credential-theft opportunity into a platform for deeper firmware-level compromise. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain physical access to outdoor-mounted device
Delivery
Connect USB-to-serial adapter to labeled UART pads
Exploit
Power-cycle device to trigger WiFi association event
Execution
Capture cleartext SSID, PSK, and WPA keys from console output
Persist
Authenticate to host WiFi network with recovered credentials
Impact
Execute RT-Thread shell commands for arbitrary memory reads and firmware extraction
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Physical access to the device PCB is required to connect to the UART debug pads. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.1 reflects the physical access requirement (AV:P), which is the primary risk limiter and prevents remote or automated mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targets an outdoor-mounted Naxclow Smart Doorbell X3 during a brief unobserved window - for example, during a delivery, maintenance visit, or after-hours approach. Using a USB-to-serial adapter connected to the labeled UART pads (no disassembly required if pads are edge-accessible), the attacker power-cycles the device to trigger a WiFi association event and captures the SSID, PSK, and WPA session keys printed in cleartext to the console. …
Remediation No vendor-released patch version has been identified from the available data; the CPE wildcard entries suggest no patched firmware release has been scoped at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Smart Doorbell X3

View all
CVE-2026-50101 CRITICAL
9.2 Jun 12

Persistent credential exposure in Naxclow smart cameras and doorbells (Smart Doorbell X3, X Smart Home, V720, ix Cam) al
CVE-2026-28742 CRITICAL
9.2 Jun 12

Cryptographic authentication bypass in Naxclow smart home devices (Smart Doorbell X3, X Smart Home, V720, Ix Cam) allows
CVE-2026-42947 HIGH
8.7 Jun 12

Device takeover in Naxclow's IoT platform (Smart Doorbell X3, X Smart Home, V720, and iX Cam) allows any authenticated a
CVE-2026-50108 HIGH
8.7 Jun 12

Unauthorized credential disclosure in the Naxclow IoT platform API (affecting Smart Doorbell X3, X Smart Home, V720, and
CVE-2026-50244 MEDIUM
6.9 Jun 12

Fleet enumeration in the Naxclow smart home platform (Smart Doorbell X3, X Smart Home, V720, Ix Cam) allows unauthentica
CVE-2026-42932 MEDIUM
6.9 Jun 12

Device identifier enumeration across Naxclow's IoT product line - including the Smart Doorbell X3, X Smart Home platform

Same weakness CWE-538 – Insertion of Sensitive Information into Externally-Accessible File

View all
CVE-2024-51977 MEDIUM POC
5.3
CVE-2016-20024 CRITICAL POC
9.3
CVE-2020-37104 HIGH POC
7.5
CVE-2025-12059 CRITICAL
9.8
CVE-2026-7071 MEDIUM POC
5.5
CVE-2026-6160 MEDIUM POC
5.5
CVE-2026-10254 MEDIUM POC
5.5
CVE-2026-21672 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Share

EUVD-2026-36538 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy