Is CVE-2026-42947 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42947 being exploited in the wild.

How severe is CVE-2026-42947?

High severity, with a CVSS score of 8.8, published 12 June 2026.

Which products and versions are affected?

Naxclow Ix Cam all; Naxclow Smart Doorbell X3 all; Naxclow V720 all; Naxclow X Smart Home all.

Is there a fix for CVE-2026-42947?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42947 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42947?

Check whether you run Naxclow Ix Cam, Naxclow Smart Doorbell X3, Naxclow V720 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42947: Naxclow IoT Platform authorization bypass in onboarding workflow

CVE-2026-42947 · Severity: high · CVSS 8.8 · Published 2026-06-12

A security flaw in the Naxclow IoT platform's device setup process allows unauthorized users to hijack smart home devices, such as doorbells and cameras. By replaying specific setup commands, an attacker can silently reassign a device to their own account without the legitimate owner's knowledge. This could lead to unauthorized surveillance, access to private video feeds, and complete loss of control over the affected smart home hardware.

Technologies: Naxclow Ix Cam, Naxclow Smart Doorbell X3, Naxclow V720, Naxclow X Smart Home. Vendors: Naxclow.

Quick answers

Is CVE-2026-42947 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42947 being exploited in the wild.
How severe is CVE-2026-42947?: High severity, with a CVSS score of 8.8, published 12 June 2026.
Which products and versions are affected?: Naxclow Ix Cam all; Naxclow Smart Doorbell X3 all; Naxclow V720 all; Naxclow X Smart Home all.
Is there a fix for CVE-2026-42947?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42947 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42947?: Check whether you run Naxclow Ix Cam, Naxclow Smart Doorbell X3, Naxclow V720 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as an Authorization Bypass Through User-Controlled Key (CWE-639) within the Naxclow IoT platform's onboarding workflow. The root cause is a failure in the 'confirm-then-bind' sequence where the platform validates request signatures but fails to verify the legitimate ownership of the device being bound. An attacker with a valid platform account can replay this sequence to silently reassign a target device to their own account. This attack can be executed over the network without user interaction, and the device remains operational and unaware of the change in ownership. As of the advisory date, the vendor has not responded to coordination attempts, and no official patch is available.

Affected products

Naxclow Smart Doorbell X3 all
Naxclow X Smart Home all
Naxclow V720 all
Naxclow ix cam all

Timeline

2026-06-11: advisory: CISA ICSA-26-162-02 published
2026-06-12: disclosed: CVE-2026-42947 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.