Naxclow Smart Doorbell X3
7 CVEs affecting Naxclow Smart Doorbell X3. Latest disclosed: 2026-06-12. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28742 | Critical | 9.8 | 2026-06-12 | Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered fr… |
CVE-2026-42947 | High | 8.8 | 2026-06-12 | A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary acco… |
CVE-2026-50101 | High | 8.1 | 2026-06-12 | Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains… |
CVE-2026-50108 | High | 7.5 | 2026-06-12 | The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate… |
CVE-2026-50244 | Medium | 5.3 | 2026-06-12 | The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier… |
CVE-2026-42932 | Medium | 5.3 | 2026-06-12 | Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. B… |
CVE-2026-50099 | Medium | 4.6 | 2026-06-12 | During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on produc… |