CVE-2026-42932 describes a vulnerability in the Naxclow Smart Doorbell X3 where device identifiers are generated using fixed manufacturing prefixes concatenated with sequential counters. This approach creates a fully predictable and enumerable identifier space. Additionally, the platform exposes an endpoint that discloses the current highest identifier assigned, enabling an attacker to enumerate all active devices. This predictable identifier generation violates secure random number generation best practices, classified as CWE-340. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

An attacker can enumerate the entire fleet of active Naxclow Smart Doorbell X3 devices by leveraging the predictable identifier scheme and the exposed endpoint revealing the highest assigned identifier. This could facilitate targeted attacks, privacy violations, or unauthorized access attempts. However, the vulnerability does not require privileges or user interaction and has a low complexity of attack, resulting in a medium severity rating (CVSS 6.9).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates. No official mitigation or workaround is currently documented.