The Naxclow Smart Doorbell X3 platform API that returns device relay registration details suffers from missing authorization (CWE-862). It does not verify that the requester is authorized to access the persistent credentials it exposes. Consequently, an actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and impersonate those devices on the relay, enabling interception and disruption of device communications. This vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. There is no vendor advisory or patch information available, and the affected versions are not explicitly stated.

An attacker who can generate a valid platform request signature can obtain persistent credentials for any device on the platform. This allows the attacker to register as that device on the relay, potentially intercepting or disrupting communications between the device and the platform. This compromises confidentiality and availability of the affected devices' communications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to platform request signing capabilities and monitor for unauthorized device registrations if possible.