Vulnerability · Published Jun 12, 2026 · Assigned by icscert
CVE-2026-50099Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory
Medium 4.6
In plain English
A medium-severity security flaw in ix cam from Naxclow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Naxclow | Smart Doorbell X3 | All |
| Naxclow | X Smart Home | All |
| Naxclow | V720 | All |
| Naxclow | ix cam | All |
Weakness: CWE-538 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N