Description
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can take over a device without user interaction while the device remains online and unaware.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Naxclow Smart Doorbell X3
Default version status: unaffected
Allaffected
Naxclow X Smart Home
Default version status: unaffected
Allaffected
Naxclow V720
Default version status: unaffected
Allaffected
Naxclow ix cam
Default version status: unaffected
Allaffected