What’s Vulnerable › Vulnerabilities

CVE-2026-28742: Naxclow IoT Platform Use of hard-coded cryptographic key

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-12 · updated 2026-06-17
• Weakness: CWE-321

Description

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.

Affected products

• Naxclow ix cam: all versions
• Naxclow Smart Doorbell X3: all versions
• Naxclow V720: all versions
• Naxclow X Smart Home: all versions

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-02.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02

Get alerted when CVE-2026-28742 or the next vulnerability affects your stack