CVE-2026-50101: Naxclow Device Auth Bypass Vulnerability

CVE-2026-50101 Overview

CVE-2026-50101 affects Naxclow devices that rely on a server-side, per-device relay credential that never rotates. The credential is re-issued to the device on each boot and remains valid indefinitely. Legitimate owners cannot reset or revoke it, even after a factory reset or re-onboarding the device.

Any party that obtains this credential through any exposure path can maintain persistent access to the device's relay channel. This enables long-term impersonation of the device or interception of its relayed traffic. The flaw is classified under [CWE-262] (Not Using Password Aging) and was published in CISA ICS Advisory ICSA-26-162-02.

Critical Impact
Attackers with one-time access to the relay credential retain persistent control of the device's communications channel, surviving resets and re-provisioning.

Affected Products

Naxclow devices (specific models and firmware versions not enumerated in NVD data)
Cloud relay infrastructure that issues and accepts the per-device credential
Mobile and web clients that connect to affected devices through the relay channel

Discovery Timeline

2026-06-12 - CVE-2026-50101 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50101

Vulnerability Analysis

Naxclow devices authenticate to a vendor-operated relay service using a per-device credential generated server-side. The relay service re-issues the same credential to the device on every boot. This design treats the credential as a permanent identifier rather than a rotatable secret.

The credential has no expiration window and no revocation mechanism exposed to device owners. Factory resets do not invalidate it because the server, not the device, is the authoritative source. Re-onboarding the device under a different account does not generate a new credential either.

An attacker who captures the credential through any disclosure path can connect to the relay channel as if they were the device. The relay forwards traffic to and from clients that trust the device identity. Owners have no administrative path to detect or evict the unauthorized session.

Root Cause

The root cause is a credential lifecycle design flaw [CWE-262]. The system lacks credential rotation, expiration, and owner-controlled revocation. The server bound the credential to the hardware identity rather than to an account session, removing the user from the trust lifecycle.

Attack Vector

Exploitation requires the attacker to first obtain the per-device relay credential. Disclosure paths include network interception, prior physical access, supply chain exposure, or compromise of any system that handled the credential. Once obtained, the attacker connects to the relay over the network without further authentication challenges. See the CISA ICS Advisory ICSA-26-162-02 for vendor and protocol details.

No verified proof-of-concept code is published for this issue. Refer to the GitHub CSAF Document for the structured advisory data.

Detection Methods for CVE-2026-50101

Indicators of Compromise

Duplicate relay sessions associated with a single device identifier originating from unexpected geographies or autonomous systems.
Device telemetry or media streams reaching clients that were never legitimately paired with the device account.
Persistent unauthorized access that survives factory reset, firmware update, or account re-onboarding.

Detection Strategies

Monitor outbound network flows from Naxclow devices for connections to relay endpoints from secondary source addresses or sessions running in parallel with the legitimate device.
Baseline relay connection frequency and session duration per device, then alert on deviations that suggest a second client impersonating the device.
Correlate client-side application logs for stream access events that do not align with authorized user activity windows.

Monitoring Recommendations

Capture and retain DNS and TLS metadata for the vendor relay domains to support retrospective analysis.
Segment Naxclow devices onto an isolated VLAN where east-west and north-south traffic can be fully logged.
Forward network telemetry from the segment to a central analytics platform for long-term correlation across reboots and reprovisioning events.

How to Mitigate CVE-2026-50101

Immediate Actions Required

Inventory all Naxclow devices in the environment and document their network placement and exposure.
Restrict outbound network access for affected devices to only the vendor endpoints required for operation, blocking unsolicited inbound traffic.
Treat any device whose relay credential may have been exposed as compromised, and avoid using it for sensitive monitoring use cases until the vendor issues a fix.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-50101 at the time of publication. Consult the CISA ICS Advisory ICSA-26-162-02 and the GitHub CSAF Document for the latest vendor coordination status and any remediation guidance.

Workarounds

Place affected devices behind a firewall that blocks the vendor relay protocol and use a customer-controlled VPN or local-only access pathway instead.
Disable cloud relay functionality in the device or mobile application settings where the option exists, and rely on local network access.
Retire affected devices from environments handling sensitive video, audio, or sensor data until the vendor introduces credential rotation and owner-controlled revocation.

bash

# Configuration example: block relay egress at the network edge
# Replace VENDOR_RELAY_CIDR with the vendor's published relay ranges
iptables -I FORWARD -s 10.20.30.0/24 -d VENDOR_RELAY_CIDR -j DROP
iptables -I FORWARD -s 10.20.30.0/24 -p udp --dport 8000:9000 -j DROP