CVE-2026-50101: falha crítica em Naxclow ix cam
Naxclow IoT Platform Not using password aging
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.2epss 0.3%
Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it through any exposure path can maintain persistent access to the device’s relay channel. This enables long-term impersonation or interception, even after factory resets or re-onboarding.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVEs relacionadas — Naxclow ix cam
No mesmo produto, das mais perigosas para as menos.
CVE-2026-28742CRITICALNaxclow IoT Platform Use of hard-coded cryptographic keyEPSS 0.3%CVE-2026-42947HIGHNaxclow IoT Platform Authorization bypass through User-Controlled keyEPSS 0.3%CVE-2026-50108HIGHNaxclow IoT Platform Missing AuthorizationEPSS 0.3%CVE-2026-42932MEDIUMNaxclow IoT Platform Generation of Predictable Numbers or IdentifiersEPSS 0.2%CVE-2026-50244MEDIUMNaxclow IoT Platform Missing AuthorizationEPSS 0.2%CVE-2026-50099MEDIUMNaxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directoryEPSS 0.2%