CVE-2026-42947: Naxclow IoT Platform Authorization bypass through User-Controlled key

Synopsis

An authorization bypass in the Naxclow IoT Platform allows an authenticated attacker to silently reassign any online device to an arbitrary account by replaying a confirm-then-bind sequence in the onboarding workflow. The affected endpoints validate request signatures but do not confirm legitimate device ownership, meaning any low-privilege account holder can execute the attack over the network without any interaction from the device owner. Successful exploitation gives the attacker full control over the targeted device, enabling them to read its data streams, modify its configuration, and deny access to the legitimate owner. No fix versions have been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable onboarding endpoints are exposed over the network, so the attacker must be able to reach the Naxclow platform service remotely.

• AuthenticationRequired

  The attacker must hold any valid low-privilege Naxclow account; no elevated or administrative credentials are needed.

• Victim interactionNot required

  The attack completes silently while the target device is online; no action is required from the device owner or any other user.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring only a replayed confirm-then-bind request sequence with no race conditions or special environmental setup.

Blast Radius

• Attacker gains ownership of the targeted device and can read its live data streams, including video or sensor feeds from affected products such as the Smart Doorbell X3 or ix cam.
• Attacker can modify device configuration, alter behavior settings, and issue commands to the reassigned device.
• Legitimate owner loses access to the device and receives no notification of the reassignment, as the device remains online and unaware of the takeover.
• All affected Naxclow product lines (Smart Doorbell X3, X Smart Home, V720, ix cam) across all firmware versions are in scope.