CVE-2026-50108

Deferred Deferred - Pending Action

Naxclow Platform API Credential Exposure Vulnerability

Publication date: 2026-06-12

Last updated on: 2026-06-16

Assigner: ICS-CERT

Description

The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and register on the relay as that device, enabling interception and disruption of its communications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-16

Generated

2026-07-03

AI Q&A

2026-06-12

EPSS Evaluated

2026-07-01

NVD

CVE-2026-50108

EUVD

EUVD-2026-36529

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Impact Analysis

This vulnerability can lead to unauthorized access to device credentials, allowing attackers to impersonate devices on the network.

As a result, attackers can intercept sensitive communications and disrupt device operations, potentially causing data breaches or service interruptions.

Executive Summary

The vulnerability in the Naxclow platform API allows an attacker to obtain persistent credentials for any device without verifying if the requester is the legitimate device or owner.

An attacker who can present a platform-valid request signature can retrieve these credentials and register on the relay as that device.

This enables the attacker to intercept and disrupt communications intended for the legitimate device.

Hi! I’m here to help you understand CVE-2026-50108. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70