CVE-2026-50101
Naxclow IoT Platform Not using password aging
- State
- Published
- Severity
- 9.2 Critical
- Published
- Jun 12, 2026
- Updated
- Jun 12, 2026
- Reserved
- Jun 8, 2026
Description
Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it through any exposure path can maintain persistent access to the device’s relay channel. This enables long-term impersonation or interception, even after factory resets or re-onboarding.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | icscert |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | icscert |
Weaknesses
- CWE-262 Not using password aging
Affected Products
| Product | Versions |
|---|---|
Smart Doorbell X3Naxclow |
|
X Smart HomeNaxclow |
|
V720Naxclow |
|
ix camNaxclow |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.