CVE-2026-28742
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations, leading to request forgery and impersonation.
Risk Assessment
The absence of per-device keys and replay protections poses a significant security risk to the platform, allowing attackers to take control of devices and user accounts.
Recommendation
It is recommended to implement unique keys for each device and introduce replay protection mechanisms. Additionally, transitioning to a secure HTTPS protocol for control-plane traffic is advised.
Other vulnerabilities in Urządzenia Naxclow
See all- CVE-2026-50101High
Naxclow devices use a static relay credential that is not rotated and is re-issued to the device on each boot. This credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner.
- CVE-2026-42932Medium
Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Additionally, the platform exposes an endpoint that reveals the current identifier high-water mark, allowing for enumeration of the active fleet.
Original NVD description (English source)
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS