PT-2026-48951 · Naxclow · Smart Doorbell X3+3

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-28742

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2026-28742

Affected Products

Smart Doorbell X3

V720

Smarthome

Ix Cam

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-28742 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-02.json · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-162-02 · Note