Is CVE-2026-50101 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50101 being exploited in the wild.

How severe is CVE-2026-50101?

High severity, with a CVSS score of 8.1, published 12 June 2026.

Which products and versions are affected?

Naxclow IoT Platform All versions; Naxclow Ix Cam All versions; Naxclow Smart Doorbell X3 All versions; Naxclow V720 All versions; and 1 more.

Is there a fix for CVE-2026-50101?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50101 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50101?

Check whether you run Naxclow IoT Platform, Naxclow Ix Cam, Naxclow Smart Doorbell X3 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50101: Naxclow IoT Platform static relay credentials in multiple devices

CVE-2026-50101 · Severity: high · CVSS 8.1 · Published 2026-06-12

Naxclow smart home devices, including doorbells and cameras, use permanent security credentials that never expire or change. If these credentials are stolen or leaked, an unauthorized person can permanently monitor or impersonate the device. This access remains active even if the owner performs a factory reset or re-registers the device.

Technologies: Naxclow IoT Platform, Naxclow Ix Cam, Naxclow Smart Doorbell X3, Naxclow V720, Naxclow X Smart Home. Vendors: Naxclow.

Quick answers

Is CVE-2026-50101 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50101 being exploited in the wild.
How severe is CVE-2026-50101?: High severity, with a CVSS score of 8.1, published 12 June 2026.
Which products and versions are affected?: Naxclow IoT Platform All versions; Naxclow Ix Cam All versions; Naxclow Smart Doorbell X3 All versions; Naxclow V720 All versions; and 1 more.
Is there a fix for CVE-2026-50101?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50101 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50101?: Check whether you run Naxclow IoT Platform, Naxclow Ix Cam, Naxclow Smart Doorbell X3 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as CWE-262 (Not Using Password Aging). Naxclow IoT devices utilize a static, per-device relay credential for communication that is re-issued upon every boot cycle without rotation. Because the server-side platform does not support credential revocation or expiration, any actor who obtains the credential can maintain persistent access to the device's relay channel. This allows for long-term interception of data or device impersonation. The attack is reachable over the network, though it requires the attacker to first obtain the static credential through other exposure paths. No patch is currently available as the vendor did not respond to coordination efforts.

Affected products

Naxclow Smart Doorbell X3 All versions
Naxclow X Smart Home All versions
Naxclow V720 All versions
Naxclow ix cam All versions
Naxclow IoT Platform All versions

Timeline

2026-06-11: advisory: CISA ICSA-26-162-02 published
2026-06-12: disclosed: CVE-2026-50101 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.