Vulnerability · Published Jun 12, 2026 · Assigned by icscert
CVE-2026-28742Naxclow IoT Platform Use of hard-coded cryptographic key
Critical 9.8
In plain English
A critical-severity security flaw in ix cam from Naxclow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Naxclow | Smart Doorbell X3 | All |
| Naxclow | X Smart Home | All |
| Naxclow | V720 | All |
| Naxclow | ix cam | All |
Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H