Is CVE-2026-28742 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28742 being exploited in the wild.

How severe is CVE-2026-28742?

Critical severity, with a CVSS score of 9.8, published 12 June 2026.

Which products and versions are affected?

Naxclow IoT Platform All versions; Naxclow Ix Cam All versions; Naxclow Smart Doorbell X3 All versions; Naxclow V720 All versions; and 1 more.

Is there a fix for CVE-2026-28742?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-28742 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28742?

Check whether you run Naxclow IoT Platform, Naxclow Ix Cam, Naxclow Smart Doorbell X3 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28742: Naxclow IoT Platform hard-coded cryptographic salt in request signing

CVE-2026-28742 · Severity: critical · CVSS 9.8 · Published 2026-06-12

Naxclow smart home devices, including doorbells and cameras, use a single shared security key across all units worldwide. An attacker who discovers this key can impersonate any user or device, potentially gaining unauthorized access to video feeds or account settings. Because the system also lacks modern encryption for its control traffic, these unauthorized commands can be sent easily over the internet.

Technologies: Naxclow IoT Platform, Naxclow Ix Cam, Naxclow Smart Doorbell X3, Naxclow V720, Naxclow X Smart Home. Vendors: Naxclow.

Quick answers

Is CVE-2026-28742 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28742 being exploited in the wild.
How severe is CVE-2026-28742?: Critical severity, with a CVSS score of 9.8, published 12 June 2026.
Which products and versions are affected?: Naxclow IoT Platform All versions; Naxclow Ix Cam All versions; Naxclow Smart Doorbell X3 All versions; Naxclow V720 All versions; and 1 more.
Is there a fix for CVE-2026-28742?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-28742 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28742?: Check whether you run Naxclow IoT Platform, Naxclow Ix Cam, Naxclow Smart Doorbell X3 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from the use of a hard-coded cryptographic salt (CWE-321) shared across all Naxclow firmware images for request signing. Because the platform lacks per-device keys, server-side nonce tracking, or replay protections, an attacker who extracts the salt from any single device can generate valid signatures for arbitrary account or device operations. This is further exacerbated by the use of unencrypted HTTP for control-plane traffic, allowing a remote, unauthenticated attacker to perform large-scale request forgery and impersonation. As of the advisory date, the vendor has not responded to coordination attempts, and no official patch is available.

Affected products

Naxclow Smart Doorbell X3 All versions
Naxclow X Smart Home All versions
Naxclow V720 All versions
Naxclow ix cam All versions
Naxclow IoT Platform All versions

Timeline

2026-06-11: advisory: CISA ICSA-26-162-02 published
2026-06-12: disclosed: CVE-2026-28742 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.