CVE-2026-50101: Naxclow IoT Platform Not using password aging

Synopsis

This is a credential-management flaw in the Naxclow IoT platform affecting the Smart Doorbell X3, X Smart Home, V720, and ix cam product lines. The platform issues a per-device relay credential that never expires, cannot be revoked, and is reissued on every boot, meaning any party who obtains the credential retains permanent access to the device's relay channel regardless of factory resets or re-onboarding. Successful exploitation enables persistent impersonation or traffic interception of the affected device's relay communication. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's relay service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is needed.

• AuthenticationNot required

  No credential or account is needed to attempt exploitation; PR:N indicates the attacker operates without any prior authentication.

• Victim interactionNot required

  The exploit requires no action from the device owner or any other user; UI:N means the attack proceeds entirely without victim participation.

• Attack complexityDetail

  AC:H indicates the exploit is not condition-free; the attacker must acquire the per-device relay credential through some prior exposure path before the persistent-access capability can be exercised.

Blast Radius

• Attacker gains persistent read access to the device relay channel, enabling interception of video feeds, audio streams, or sensor data transmitted through that channel.
• Attacker can impersonate the legitimate device on the relay service, sending or injecting commands as if they were the enrolled device.
• Access persists through factory resets and re-onboarding because the credential is reissued unchanged on each boot, making standard recovery procedures ineffective.
• Confidentiality, integrity, and availability of the affected device's relay communications are all fully compromised per VC:H, VI:H, VA:H impact ratings.