Urządzenia Naxclow vulnerabilities

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations, leading to request forgery and impersonation.

Naxclow devices use a static relay credential that is not rotated and is re-issued to the device on each boot. This credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner.

Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Additionally, the platform exposes an endpoint that reveals the current identifier high-water mark, allowing for enumeration of the active fleet.