CVE-2026-42932: Naxclow Ix Cam

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated.

Affected products

• Naxclow Ix Cam: any version
• Naxclow Smart Doorbell x3: any version
• Naxclow v720: any version
• Naxclow X Smart Home: any version

Published 2026-06-12. Last modified 2026-06-17.