CVE-2026-42947

Name of the Vulnerable Software and Affected Versions Naxclow Smart Doorbell X3 (affected versions not specified) Naxclow platform (affected versions not specified)

Description A flaw in the onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. The affected endpoints validate request signatures but fail to confirm legitimate ownership, enabling an attacker with any account to take over a device without user interaction while the device remains online.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.