Vulnerability Description
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for control-plane traffic, the construction enables broad request forgery and impersonation across the platform.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-16
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02
FAQ
What is CVE-2026-28742?
CVE-2026-28742 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate v...
How severe is CVE-2026-28742?
CVE-2026-28742 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-28742?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.