This vulnerability in Naxclow Smart Doorbell X3 involves an authorization bypass (CWE-639) where the onboarding workflow's confirm-then-bind sequence can be replayed by an attacker. Although request signatures are validated, the system fails to confirm that the requester legitimately owns the device. Consequently, an attacker with any account can silently reassign the device to themselves without alerting the current owner or requiring user interaction. This affects all versions of the product. The CVSS 4.0 base score is 8.7, reflecting network attack vector, low complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with any account can take over a Naxclow Smart Doorbell X3 device by replaying the confirm-then-bind sequence, effectively reassigning the device to their account without the legitimate owner's knowledge or interaction. This compromises device ownership and control, potentially allowing unauthorized access to device functions and data.

No patch or official fix is currently available for this vulnerability. Users and administrators should monitor the vendor's advisory channels for updates. Until a fix is released, restricting account access and monitoring device onboarding activities may help reduce risk, but no definitive mitigation is confirmed.