CVE-2026-50101
published 2026-06-12CVE-2026-50101: Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains…
PriorityP352high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.28%
19.8th percentile
Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it through any exposure path can maintain persistent access to the device’s relay channel. This enables long-term impersonation or interception, even after factory resets or re-onboarding.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| naxclow | ix_cam | — | — |
| naxclow | smart_doorbell_x3 | — | — |
| naxclow | v720 | — | — |
| naxclow | x_smart_home | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Naxclow Smart Doorbell X3/X Smart Home/V720/ix cam Factory Reset no password aging (icsa-26-162-02 / EUVD-2026-36526)
vuldb·2026-06-12·CVSS 8.1
CVE-2026-50101 [HIGH] Naxclow Smart Doorbell X3/X Smart Home/V720/ix cam Factory Reset no password aging (icsa-26-162-02 / EUVD-2026-36526)
A vulnerability categorized as critical has been discovered in Naxclow Smart Doorbell X3, X Smart Home, V720 and ix cam. This affects an unknown function of the component Factory Reset Handler. The manipulation results in not using password aging.
This vulnerability is identified as CVE-2026-50101. The attack can be executed remotely. There is not any exploit available.
GHSA
Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot.
ghsa_unreviewed·2026-06-12
CVE-2026-50101 [CRITICAL] CWE-262 Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot.
Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it through any exposure path can maintain persistent access to the device’s relay channel. This enables long-term impersonation or interception, even after factory resets or re-onboarding.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-12
Published