# CVE-2026-42932: Naxclow IoT Platform predictable device identifier generation

Source: https://junglewise.ai/threats/cve-2026-42932-naxclow-iot-platform-predictable-device-identifier-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-42932 · Severity: medium · CVSS 5.3 · Published 2026-06-12

The Naxclow IoT platform, which manages smart home devices like doorbells and cameras, uses predictable identification numbers for its hardware. Because these IDs are sequential and the platform publicly reveals the total number of registered devices, an attacker can easily map out and identify every active device in the company's fleet. This information can be used as a starting point for more targeted attacks against specific users or hardware.

Technologies: [Naxclow IoT Platform](https://junglewise.ai/threats/technologies/iot-platform), [Naxclow Ix Cam](https://junglewise.ai/threats/technologies/ix-cam), [Naxclow Smart Doorbell X3](https://junglewise.ai/threats/technologies/smart-doorbell-x3), [Naxclow V720](https://junglewise.ai/threats/technologies/v720), [Naxclow X Smart Home](https://junglewise.ai/threats/technologies/x-smart-home). Vendors: [Naxclow](https://junglewise.ai/threats/vendors/naxclow).

## Quick answers

**Is CVE-2026-42932 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42932 being exploited in the wild.

**How severe is CVE-2026-42932?** Medium severity, with a CVSS score of 5.3, published 12 June 2026.

**Which products and versions are affected?** Naxclow IoT Platform All versions; Naxclow Ix Cam All versions; Naxclow Smart Doorbell X3 All versions; Naxclow V720 All versions; and 1 more.

**Is there a fix for CVE-2026-42932?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42932 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-42932?** Check whether you run Naxclow IoT Platform, Naxclow Ix Cam, Naxclow Smart Doorbell X3 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a case of predictable identifier generation (CWE-340) within the Naxclow IoT Platform. Device IDs are constructed using static manufacturing prefixes followed by sequential counters. Furthermore, a platform endpoint reveals the 'high-water mark' (the highest current ID), allowing a remote, unauthenticated attacker to systematically enumerate the entire active device fleet via the network. This enumeration can facilitate targeted exploitation when combined with other vulnerabilities in the platform's authorization or communication protocols. As of the advisory date, the vendor has not responded to coordination attempts, and no official patch is available.

## Affected products

- Naxclow Smart Doorbell X3 All versions
- Naxclow X Smart Home All versions
- Naxclow V720 All versions
- Naxclow ix cam All versions
- Naxclow IoT Platform All versions

## Timeline

- 2026-06-11: advisory: CISA ICSA-26-162-02 published
- 2026-06-12: disclosed: CVE-2026-42932 published in NVD

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02)

## Related threats

- [Naxclow IoT Platform missing authorization in registration endpoint](https://junglewise.ai/threats/cve-2026-50244-naxclow-iot-platform-missing-authorization-in-registration)
- [Naxclow IoT Platform missing authorization in relay registration API](https://junglewise.ai/threats/cve-2026-50108-naxclow-iot-platform-missing-authorization-in-relay-registration)
- [Naxclow IoT Platform static relay credentials in multiple devices](https://junglewise.ai/threats/cve-2026-50101-naxclow-iot-platform-static-relay-credentials-in-multiple-devices)
- [Naxclow IoT devices sensitive information disclosure via UART console](https://junglewise.ai/threats/cve-2026-50099-naxclow-iot-devices-sensitive-information-disclosure-via-uart)
- [Naxclow IoT Platform authorization bypass in onboarding workflow](https://junglewise.ai/threats/cve-2026-42947-naxclow-iot-platform-authorization-bypass-in-onboarding-workflow)