CVE-2026-28742: Naxclow Ix Cam

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.

Affected products

• Naxclow Ix Cam: any version
• Naxclow Smart Doorbell x3: any version
• Naxclow v720: any version
• Naxclow X Smart Home: any version

Published 2026-06-12. Last modified 2026-06-17.