CVE-2026-50101 Naxclow IoT Platform Not using password aging
Attackers with exposed relay credentials can maintain persistent access to Naxclow IoT devices, enabling long-term impersonation and interception.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-50101?
CVE-2026-50101 is a critical vulnerability in Naxclow Smart Doorbell X3, published on 12 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner, any party that obtains it through any exposure path can maintain persistent access to the device’s relay channel. This enables long-term impersonation or interception, even after factory resets or re-onboarding.
Weakness: CWE-262
Which versions are affected by CVE-2026-50101?
How do I fix CVE-2026-50101?
No fix has been published for CVE-2026-50101 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-50101 being exploited?
There is no known exploitation of CVE-2026-50101 in the wild and no public exploit code.
Sources
Also known as GHSA-x3mh-94rm-26c7.