QSearchQSearch

CVE-2026-28742

9.8 CRITICAL

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image

Published: 2026-06-12 · Last updated: 2026-06-12

Severity and scoring

CVSS
9.8 CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-321

Description

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-50091 — Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptog... (9.1 CRITICAL)
  • CVE-2026-11505 — A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x (5.0 MEDIUM)
  • CVE-2026-46395 — HAX CMS helps manage microsite universe with PHP or NodeJs backends
  • CVE-2026-11347 — The linqi application contains hardcoded cryptographic keys
  • CVE-2026-45433 — This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware