Registration Endpoint Enumeration in Naxclow Platform

Executive Summary

The vulnerability in the Naxclow platform involves a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier without verifying if the caller actually owns that account.

Each request to this endpoint mints a new sequential device identifier and returns the current high-water counter value for the batch, which allows an attacker to measure and enumerate the active device space precisely.

Because there is no validation of ownership, unauthorized users can exploit this behavior to enumerate devices in the system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized parties to enumerate the active devices registered in the Naxclow platform.

Such precise fleet enumeration can lead to information disclosure, potentially aiding attackers in mapping the device landscape and planning further attacks.

Useful 0 Not Useful 0