CVE-2026-28742
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile — higher than 39% of all known CVEs
Summary
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations, leading to request forgery and impersonation.
Risk Assessment
The absence of per-device keys and replay protections poses a significant security risk to the platform, allowing attackers to take control of devices and user accounts.
Recommendation
It is recommended to implement unique keys for each device and introduce replay protection mechanisms. Additionally, transitioning to a secure HTTPS protocol for control-plane traffic is advised.
Original NVD description (English source)
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.