These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Naxclow platform has a vulnerability, tracked as CVE-2026-50244, which exposes a registration endpoint that accepts signed requests with a batch prefix and an arbitrary caller-supplied account identifier. This endpoint does not validate any ownership relationship, allowing callers to measure and enumerate the active device space by minting new sequential device identifiers and retrieving the current h [truncated]
CVE-2026-50108 is a HIGH-severity vulnerability in the Naxclow platform API. The API returns device relay registration details without verifying the requester's identity, allowing an attacker to retrieve credentials for arbitrary devices and register on the relay as that device. This enables interception and disruption of its communications.
A critical vulnerability, CVE-2026-50101, has been identified in Naxclow devices. The issue arises from a server-side, per-device relay credential that is re-issued to the device on each boot and remains valid indefinitely. This allows any party that obtains the credential through any exposure path to maintain persistent access to the device's relay channel, enabling long-term impersonation or interceptio [truncated]
CVE-2026-50099 is a medium-severity vulnerability (CVSS Score: 5.1) affecting Naxclow device firmware. During WiFi association, the firmware prints the host network's SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, e [truncated]
A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can take over a device without user interaction while the device remains online and unaware.
CVE-2026-42932 is a vulnerability in Naxclow device identifiers. The identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. The platform also exposes an endpoint that reveals the current identifier high-water mark, allowing the active fleet to be enumerated. The CVSS score for this vulnerability is 6.9, and the severit [truncated]
CVE-2026-28742 is a critical vulnerability in Naxclow devices that enables an attacker to generate valid signatures for arbitrary device or account operations. This is due to the use of a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image, combined with the system's use of plain HTTP for control-plane traffic.