CVE-2026-42932: falha de média gravidade em Naxclow ix cam
Naxclow IoT Platform Generation of Predictable Numbers or Identifiers
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.2%
Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVEs relacionadas — Naxclow ix cam
No mesmo produto, das mais perigosas para as menos.
CVE-2026-28742CRITICALNaxclow IoT Platform Use of hard-coded cryptographic keyEPSS 0.3%CVE-2026-42947HIGHNaxclow IoT Platform Authorization bypass through User-Controlled keyEPSS 0.3%CVE-2026-50108HIGHNaxclow IoT Platform Missing AuthorizationEPSS 0.3%CVE-2026-50101CRITICALNaxclow IoT Platform Not using password agingEPSS 0.3%CVE-2026-50244MEDIUMNaxclow IoT Platform Missing AuthorizationEPSS 0.2%CVE-2026-50099MEDIUMNaxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directoryEPSS 0.2%