Vulnerability in Naxclow Ix Cam
CVE-2026-28742
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.
EPSS: 0.003 (25.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Naxclow Ix Cam — versions All
- Naxclow Smart Doorbell X3 — versions All
- Naxclow V720 — versions All
- Naxclow X Smart Home — versions All
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-28742?
- CVE-2026-28742 is a critical-severity vulnerability in Naxclow Ix Cam, classified under Use of Hard-coded Cryptographic Key. CVSS score: 9.8/10. Published 2026-06-12.
- How severe is CVE-2026-28742?
- Critical severity. CVSS v3 base score is 9.8 out of 10.