The vulnerability in Naxclow Smart Doorbell X3 (CVE-2026-50101) stems from the use of a server-side, per-device relay credential that is static and never rotated. This credential is re-issued to the device on each boot but remains valid indefinitely without any mechanism for reset or revocation by the device owner. Consequently, if an attacker obtains this credential through any exposure path, they can maintain persistent unauthorized access to the device's relay channel. This persistent access allows long-term impersonation or interception of communications, surviving factory resets or device re-onboarding processes. The vulnerability is categorized under CWE-262 (Not Using Password Aging) and has a CVSS 4.0 base score of 9.2, indicating critical severity. No patch or official remediation is currently available, and the device is not a cloud service, so remediation depends on vendor action.

An attacker who obtains the static relay credential can maintain persistent unauthorized access to the device's relay channel. This enables long-term impersonation or interception of communications with the device, even after factory resets or re-onboarding. This compromises the confidentiality and integrity of the device's communication and potentially the security of the physical premises monitored by the doorbell.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates. Until a fix is available, limiting exposure of the device to untrusted networks and restricting access paths may reduce risk, but no direct mitigation is confirmed by the vendor.