Naxclow IoT devices expose hardcoded keys, credential harvesting
Seven vulnerabilities in Naxclow IoT cameras and doorbells allow device takeover, credential theft, and fleet enumeration via hardcoded cryptographic material and missing authorization checks.
CISA disclosed seven vulnerabilities affecting all versions of Naxclow's IoT platform, including Smart Doorbell X3, X Smart Home, V720, and ix cam products deployed worldwide in commercial facilities. The flaws stem from systemic design weaknesses: a hardcoded platform-wide cryptographic salt enables request forgery across the entire device fleet, non-rotating relay credentials allow persistent impersonation, and missing authorization checks permit silent device reassignment and credential harvesting at scale. The platform's use of plain HTTP for control-plane traffic and predictable device identifiers further expand the attack surface.
An attacker with any valid account can replay onboarding sequences to hijack devices without user interaction, retrieve relay credentials for arbitrary devices, and enumerate the active fleet via exposed registration endpoints. Physical access to outdoor-mounted devices yields WiFi credentials and full firmware via an unlocked UART console that prints cleartext PSKs during boot. Naxclow did not respond to CISA's coordination attempts, and no vendor patches are available. Organizations using these products in critical infrastructure should assume compromise is straightforward and consider network segmentation and replacement.
Mentioned in this report
Detection guidance
Cleartext Credential Parameters Observed in Plain HTTP IoT Control-Plane Traffic
Detects HTTP (non-TLS) requests to device management/control-plane endpoints carrying credential-like parameters (PSK, key, salt, password) in the URL or query string, consistent with IoT platforms that transmit relay credentials and hardcoded salts over plaintext HTTP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cleartext Credential Parameters in Plain HTTP IoT Control Traffic
id: 8d81005e-0f0e-5efd-9171-8285d3ee50b3
status: experimental
description: Detects HTTP requests over unencrypted port 80/plain HTTP carrying credential-like
parameters (psk, key, salt, secret, password) in the request URI, matching behaviour
of IoT platforms that expose relay credentials and hardcoded cryptographic salts
on the control plane.
logsource:
category: proxy
product: other
detection:
selection_plain_http:
dst_port: 80
selection_cred_params:
c-uri|contains:
- psk=
- password=
- key=
- salt=
- secret=
- relay_cred
condition: selection_plain_http and selection_cred_params
falsepositives:
- Legacy internal device management tools intentionally using HTTP on isolated management
VLANs
- Test/lab environments issuing manual API calls with credential parameters for debugging
level: high
tags:
- attack.t1552.001
- attack.credential_access
author: Vorant
Repeated Device Onboarding/Registration Requests Indicative of Enumeration or Replay
Detects HTTP requests to onboarding/registration/enrollment style endpoints on IoT platform servers, which may indicate replay of onboarding sequences to hijack devices or enumeration of the device fleet via exposed registration endpoints. Analysts should correlate with volume/frequency from a single source over a short window as described in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Requests to IoT Device Onboarding or Registration Endpoints
id: 9b227576-0352-55ce-ac17-40003a885fbc
status: experimental
description: Detects requests to device onboarding, registration, or enrollment endpoints
on IoT control-plane servers. Naxclow-class platforms allow any valid account to
replay onboarding sequences to hijack devices or enumerate the fleet via these endpoints;
a high rate of such requests from a single source or covering many distinct device
identifiers in a short window is suspicious and should be investigated as enumeration/replay
activity.
logsource:
category: proxy
product: other
detection:
selection:
c-uri|contains:
- /onboard
- /onboarding
- /register
- /enroll
- /device/assign
condition: selection
falsepositives:
- Legitimate bulk device provisioning during initial fleet rollout by IT/OT staff
- Vendor-provided fleet management tools performing scheduled re-registration
level: medium
tags:
- attack.t1078
- attack.persistence
- attack.initial_access
author: Vorant
Retrieval of Relay Credentials for Arbitrary Device Identifiers via IoT API
Detects HTTP requests targeting relay-credential retrieval endpoints with a device identifier parameter, consistent with abuse of missing authorization checks that allow any authenticated account to retrieve relay credentials for arbitrary devices, enabling persistent impersonation and AiTM-style relay abuse. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Relay Credential Retrieval for Arbitrary Device via IoT Control API
id: 1e6f4c2e-a017-5d74-b96b-81324df8aab7
status: experimental
description: Detects HTTP GET/POST requests to relay-credential or device-credential
retrieval endpoints where a device identifier parameter is supplied, matching the
pattern of missing authorization checks that let any valid account harvest relay
credentials for devices they do not own, enabling adversary-in-the-middle impersonation
of the relay.
logsource:
category: proxy
product: other
detection:
selection_endpoint:
c-uri|contains:
- /relay/cred
- /relay/credentials
- /device/credentials
- /getcred
selection_device_param:
c-uri|contains:
- device_id=
- deviceId=
- devid=
condition: selection_endpoint and selection_device_param
falsepositives:
- Authorized fleet-management backend services performing legitimate bulk credential
rotation
- Internal monitoring dashboards querying credential status for owned devices only
level: high
tags:
- attack.t1557
- attack.credential_access
- attack.collection
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free