Naxclow vulnerabilities
We track 4 vulnerabilities in Naxclow products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on June 12, 2026.
Latest Naxclow vulnerabilities
- 7.5 High severity
Smart Doorbell X3: Missing Authorization
The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials
- 8.1 High severity
Smart Doorbell X3: Not Using Password Aging
Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it
- 8.8 High severity
Smart Doorbell X3: Authorization Bypass Through User-Controlled Key
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownersh
- 9.8 Critical severity
Smart Doorbell X3: Use of Hard-coded Cryptographic Key
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations d