Is CVE-2026-42932 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42932 being exploited in the wild.

How severe is CVE-2026-42932?

Medium severity, with a CVSS score of 5.3, published 12 June 2026.

Which products and versions are affected?

Naxclow IoT Platform All versions; Naxclow Ix Cam All versions; Naxclow Smart Doorbell X3 All versions; Naxclow V720 All versions; and 1 more.

Is there a fix for CVE-2026-42932?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42932 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42932?

Check whether you run Naxclow IoT Platform, Naxclow Ix Cam, Naxclow Smart Doorbell X3 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42932: Naxclow IoT Platform predictable device identifier generation

CVE-2026-42932 · Severity: medium · CVSS 5.3 · Published 2026-06-12

The Naxclow IoT platform, which manages smart home devices like doorbells and cameras, uses predictable identification numbers for its hardware. Because these IDs are sequential and the platform publicly reveals the total number of registered devices, an attacker can easily map out and identify every active device in the company's fleet. This information can be used as a starting point for more targeted attacks against specific users or hardware.

Technologies: Naxclow IoT Platform, Naxclow Ix Cam, Naxclow Smart Doorbell X3, Naxclow V720, Naxclow X Smart Home. Vendors: Naxclow.

Quick answers

Is CVE-2026-42932 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42932 being exploited in the wild.
How severe is CVE-2026-42932?: Medium severity, with a CVSS score of 5.3, published 12 June 2026.
Which products and versions are affected?: Naxclow IoT Platform All versions; Naxclow Ix Cam All versions; Naxclow Smart Doorbell X3 All versions; Naxclow V720 All versions; and 1 more.
Is there a fix for CVE-2026-42932?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42932 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42932?: Check whether you run Naxclow IoT Platform, Naxclow Ix Cam, Naxclow Smart Doorbell X3 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a case of predictable identifier generation (CWE-340) within the Naxclow IoT Platform. Device IDs are constructed using static manufacturing prefixes followed by sequential counters. Furthermore, a platform endpoint reveals the 'high-water mark' (the highest current ID), allowing a remote, unauthenticated attacker to systematically enumerate the entire active device fleet via the network. This enumeration can facilitate targeted exploitation when combined with other vulnerabilities in the platform's authorization or communication protocols. As of the advisory date, the vendor has not responded to coordination attempts, and no official patch is available.

Affected products

Naxclow Smart Doorbell X3 All versions
Naxclow X Smart Home All versions
Naxclow V720 All versions
Naxclow ix cam All versions
Naxclow IoT Platform All versions

Timeline

2026-06-11: advisory: CISA ICSA-26-162-02 published
2026-06-12: disclosed: CVE-2026-42932 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.