Threats Tagged 'cve-2026-28742'

CVE-2026-42947 is a high-severity authorization bypass vulnerability in the Naxclow Smart Doorbell X3. The flaw exists in the onboarding workflow, allowing an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. The affected endpoints validate request signatures but do not verify legitimate ownership, enabling attackers with any account to take over devices without user interaction while the device remains online and unaware.

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.