Naxclow IoT devices expose hardcoded keys, credential harvesting
Seven vulnerabilities in Naxclow IoT cameras and doorbells allow device takeover, credential theft, and fleet enumeration via hardcoded cryptographic material and missing authorization checks.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 7 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA disclosed seven vulnerabilities affecting all versions of Naxclow's IoT platform, including Smart Doorbell X3, X Smart Home, V720, and ix cam products deployed worldwide in commercial facilities. The flaws stem from systemic design weaknesses: a hardcoded platform-wide cryptographic salt enables request forgery across the entire device fleet, non-rotating relay credentials allow persistent impersonation, and missing authorization checks permit silent device reassignment and credential harvesting at scale. The platform's use of plain HTTP for control-plane traffic and predictable device identifiers further expand the attack surface.
An attacker with any valid account can replay onboarding sequences to hijack devices without user interaction, retrieve relay credentials for arbitrary devices, and enumerate the active fleet via exposed registration endpoints. Physical access to outdoor-mounted devices yields WiFi credentials and full firmware via an unlocked UART console that prints cleartext PSKs during boot. Naxclow did not respond to CISA's coordination attempts, and no vendor patches are available. Organizations using these products in critical infrastructure should assume compromise is straightforward and consider network segmentation and replacement.
Mentioned in this report
Detection guidance
Repeated Device Onboarding/Registration Requests Indicative of Enumeration or Replay
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to onboarding/registration/enrollment style endpoints on IoT platform servers, which may indicate replay of onboarding sequences to hijack devices or enumeration of the device fleet via exposed registration endpoints. Analysts should correlate with volume/frequency from a single source over a short window as described in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Requests to IoT Device Onboarding or Registration Endpoints
id: 9b227576-0352-55ce-ac17-40003a885fbc
status: experimental
description: Detects requests to device onboarding, registration, or enrollment endpoints
on IoT control-plane servers. Naxclow-class platforms allow any valid account to
replay onboarding sequences to hijack devices or enumerate the fleet via these endpoints;
a high rate of such requests from a single source or covering many distinct device
identifiers in a short window is suspicious and should be investigated as enumeration/replay
activity.
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- /onboard
- /onboarding
- /register
- /enroll
- /device/assign
condition: selection
falsepositives:
- Legitimate bulk device provisioning during initial fleet rollout by IT/OT staff
- Vendor-provided fleet management tools performing scheduled re-registration
level: medium
tags:
- attack.t1078
- attack.persistence
- attack.initial-access
author: Vorant
Retrieval of Relay Credentials for Arbitrary Device Identifiers via IoT API
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests targeting relay-credential retrieval endpoints with a device identifier parameter, consistent with abuse of missing authorization checks that allow any authenticated account to retrieve relay credentials for arbitrary devices, enabling persistent impersonation and AiTM-style relay abuse. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Relay Credential Retrieval for Arbitrary Device via IoT Control API
id: 1e6f4c2e-a017-5d74-b96b-81324df8aab7
status: experimental
description: Detects HTTP GET/POST requests to relay-credential or device-credential
retrieval endpoints where a device identifier parameter is supplied, matching the
pattern of missing authorization checks that let any valid account harvest relay
credentials for devices they do not own, enabling adversary-in-the-middle impersonation
of the relay.
logsource:
category: proxy
detection:
selection_endpoint:
c-uri|contains:
- /relay/cred
- /relay/credentials
- /device/credentials
- /getcred
selection_device_param:
c-uri|contains:
- device_id=
- deviceId=
- devid=
condition: selection_endpoint and selection_device_param
falsepositives:
- Authorized fleet-management backend services performing legitimate bulk credential
rotation
- Internal monitoring dashboards querying credential status for owned devices only
level: high
tags:
- attack.t1557
- attack.credential-access
- attack.collection
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs