CVE-2026-50108 — Naxclow IoT Platform Missing Authorization
The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. A…
Published: 2026-06-12 · CVSS: 8.7 · CVSS 4.0
The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and register on the relay as that device, enabling interception and disruption of its communications.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7