The Naxclow Smart Doorbell X3 platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier without validating any ownership relationship. Each call to this endpoint mints a new sequential device identifier and returns the current high-water counter value for the batch, enabling an attacker to measure and enumerate the active device space precisely. This behavior constitutes a missing authorization vulnerability (CWE-862) that allows unauthorized enumeration of the device fleet. The CVSS 4.0 base score is 6.9 (medium severity), with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. No known exploits are reported in the wild. There is no vendor advisory or patch information available at this time.

An attacker can enumerate the entire active device fleet by abusing the registration endpoint to mint new device identifiers and retrieve the current high-water counter value. This could lead to privacy concerns or facilitate further targeted attacks by revealing the scale and identifiers of deployed devices. However, the vulnerability does not grant direct access to device functionality or data beyond enumeration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for unusual registration endpoint activity and consider restricting access to the registration endpoint if possible. No official fix or temporary workaround has been published by the vendor.