CVE-2026-28742

Summary

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.

Affected Software

VendorProductVersion RangeStatus
NaxclowSmart Doorbell X3Allaffected
NaxclowX Smart HomeAllaffected
NaxclowV720Allaffected
Naxclowix camAllaffected

Weaknesses

  • CWE-321: CWE-321 Use of hard-coded cryptographic key

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References