Critical

Improper request-signing design in Naxclow devices

IdentifiersCVE-2026-28742CWE-798

CVE-2026-28742 is a design flaw in Naxclow devices' request-signing mechanism. The platform uses a uniform signing scheme derived from a hard-coded, platform-wide salt embedded in every firmware image rather than unique per-device secrets or keys. If an attacker extracts this salt from any firmware image or device, they can compute valid signatures for arbitrary requests affecting device or account operations across the entire platform. The issue is compounded by the absence of per-device cryptographic isolation, lack of server-side nonce tracking or replay protection, and use of plain HTTP for control-plane traffic. Together, these weaknesses allow forged signed requests to be accepted as authentic and enable cross-platform impersonation and replay.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker to forge authenticated requests for arbitrary device or account actions, impersonate legitimate devices or users across the platform, and replay previously observed requests. Because the same embedded salt is shared platform-wide, compromise of one firmware image can undermine trust for all affected devices. The use of unencrypted HTTP for control-plane traffic further increases the risk of interception, observation, and reuse of signed requests, expanding opportunities for unauthorized operations and broad platform abuse.

Mitigation

If you can’t patch tonight, do this now.

No specific vendor workaround is provided. Until a fix is available, reduce exposure by restricting network access to affected devices and management interfaces, segmenting or isolating control-plane traffic, enforcing transport encryption through compensating controls where possible, monitoring for unauthorized device or account operations, and blocking untrusted or Internet-exposed access paths. Additional defensive measures include limiting firmware access, inspecting for anomalous signed requests, and treating the shared signing secret as potentially compromised across the fleet.

Remediation

Patch, then assume compromise.

Apply a vendor-provided fix when available. Effective remediation requires redesigning the authentication scheme to eliminate the hard-coded platform-wide salt and replace it with unique per-device secrets or asymmetric keys, implementing robust server-side nonce validation and replay protection, and securing control-plane communications with HTTPS/TLS. Any remediation should also include rotation or replacement of compromised shared secrets and invalidation of trust derived from the legacy signing design.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

NaxclowDeviceshardware

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

7 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity7

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-28742

NVD

nvd.nist.gov/vuln/detail/CVE-2026-28742

MITRE CWE · CWE-798

cwe.mitre.org

github.com

github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-02.json

cisa.gov

cisa.gov/news-events/ics-advisories/icsa-26-162-02