CISA ICSA-26-162-02: Naxclow IoT Platform Vulnerabilities (CVE-2026-42947 etc)

Vulnerability Overview Vulnerability Name: Naxclow IoT Platform Release Date: June 11, 2026 Alert Code: ICSA-26-162-02 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: - Smart Doorbell X3: All versions - X Smart Home: All versions - VT20: All versions - ix cam: All versions CVSS Score: 9.8 Vendor: Naxclow Device: Naxclow IoT Platform Vulnerability Types: - Authorization bypass via user-controlled keys - Missing authorization - Authentication without passwords - Aging of hardcoded passwords - Use of hardcoded encryption keys - Generation of predictable numbers or identifiers - Injection of sensitive information into externally accessible files or directories Remediation Recommended Practices: - Minimize network exposure to ensure that all control system devices and/or systems are not accessible via the Internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote methods, such as Virtual Private Networks (VPNs), and ensure that VPNs are updated to the latest version. - Conduct appropriate impact analysis and risk assessment before deploying countermeasures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activities and adhere to CISA’s tracking and correlation procedures. - Do not click on web links or open unsolicited email attachments. - Refer to “Identifying and Avoiding Email Scams” for more information. - Refer to “Avoiding Social Engineering and Phishing Attacks” for more information. Additional Information Background: - Critical Infrastructure Sector: Commercial Facilities - Deployed Countries/Regions: Global - Company Headquarters Location: China Vulnerability List: - CVE-2026-42947 - CVE-2026-50108 - CVE-2026-50101 - CVE-2026-28742 - CVE-2026-42932 - CVE-2026-50244 - CVE-2026-50099 Acknowledgments: - Temuri Takalandze reported these vulnerabilities to CISA. Revision History: - Initial Release Date: 2026-06-11 - Revision: 1 - Summary: Initial Release Tags Sector: Commercial Facilities Sector Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories Brickcom Cameras Yarbo Android/iOS Mobile Application and Cloud Infrastructure Schneider Electric EcoStruxure Panel Server Siemens KACO Blueplanet Inverters Legal Notice and Terms of Use This product is subject to this notice and privacy and usage policies. Feedback Please share your thoughts; we have recently updated our anonymous product survey and welcome your feedback. Footer CISA Central 1-844-Say-CISA contact@cisa.dhs.gov Other Links About CISA Budget and Performance DHS.gov FOIA Requests No FEAR Act Office of Inspector General Privacy Policy Subscribe The White House USA.gov Website Feedback Summary This webpage primarily introduces multiple security vulnerabilities in the Naxclow IoT Platform, including authorization bypasses and hardcoded passwords, and provides corresponding remediation advice and best practices. The affected devices include all versions of Smart Doorbell X3, X Smart Home, VT20, and ix cam.

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-26-162-02: Naxclow IoT Platform Vulnerabilities (CVE-2026-42947 etc)