Vulnerability · Published Jun 12, 2026 · Assigned by icscert
CVE-2026-50108Naxclow IoT Platform Missing Authorization
High 7.5
In plain English
A high-severity missing authorization in ix cam from Naxclow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and register on the relay as that device, enabling interception and disruption of its communications.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Naxclow | Smart Doorbell X3 | All |
| Naxclow | X Smart Home | All |
| Naxclow | V720 | All |
| Naxclow | ix cam | All |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N