Vulnerability · Published Jun 12, 2026 · Assigned by icscert
CVE-2026-42947Naxclow IoT Platform Authorization bypass through User-Controlled key
High 8.8
In plain English
A high-severity authorization bypass via user-controlled key in ix cam from Naxclow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can take over a device without user interaction while the device remains online and unaware.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Naxclow | Smart Doorbell X3 | All |
| Naxclow | X Smart Home | All |
| Naxclow | V720 | All |
| Naxclow | ix cam | All |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H