CVE-2026-50108: Naxclow IoT Platform Missing Authorization

Synopsis

Missing authorization in the Naxclow IoT Platform API allows an unauthenticated network attacker who can produce a platform-valid request signature to retrieve persistent relay credentials for any registered device. No authentication tied to device ownership or user identity is checked before the API returns these credentials. Successful exploitation lets the attacker register on the relay as an arbitrary device, intercepting and disrupting that device's communications. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API is exposed over the network, so an attacker must be able to send HTTP requests to the Naxclow platform endpoint.

• AuthenticationNot required

  No account or ownership credential is required; any actor who can produce a platform-valid request signature can reach the vulnerable endpoint.

• Victim interactionNot required

  The attack targets the platform API directly and does not require any action from a device owner or user.

• Attack complexityDetail

  The exploit is reliable and condition-free once a valid platform request signature is obtained; no race condition or special environmental state is needed.

Blast Radius

• Reads persistent relay credentials (such as long-lived tokens or pre-shared keys) for any device registered on the Naxclow platform.
• Uses harvested credentials to register on the relay as the targeted device, positioning the attacker to intercept communications between the device and its backend.
• Disrupts normal device operation by displacing the legitimate device registration, causing the real device to lose its relay connection.
• Affects all listed Naxclow hardware lines (Smart Doorbell X3, X Smart Home, V720, ix cam), so a single credential-harvesting session can span multiple device types within one platform deployment.