The Naxclow Smart Doorbell X3 employs a request-signing scheme relying on a hard-coded cryptographic salt embedded uniformly in all firmware images. Because this salt is platform-wide and static, once extracted from any device, it enables an attacker to forge valid signatures for arbitrary device or account operations. The system lacks per-device unique keys, server-side nonce tracking, and replay protections, which combined with the use of unencrypted HTTP for control-plane communications, allows extensive request forgery and impersonation attacks across the platform. This vulnerability is tracked as CVE-2026-28742 and is classified under CWE-321 (Use of hard-coded cryptographic key). No vendor advisory or patch information is available at this time.

An attacker who obtains the hard-coded salt can impersonate devices or users on the platform, performing unauthorized operations. The absence of per-device keys and replay protections, along with unencrypted control traffic, significantly increases the risk of broad request forgery and impersonation attacks. This can lead to unauthorized control of devices and compromise of user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of the risk of device impersonation and avoid exposing devices to untrusted networks. Monitoring for unusual device behavior may help detect exploitation attempts, but no specific mitigations are provided by the vendor at this time.