Naxclow devices generate identifiers by combining a fixed manufacturing prefix with a sequential counter, creating a fully predictable and enumerable identifier space. The platform also exposes an endpoint that reveals the current high‑water mark of these identifiers, enabling an attacker to enumerate the entire active fleet. This flaw is a classic example of predictable randomness, corresponding to CWE-340, and allows an adversary to obtain key device identifiers without further intrusion.

The affected devices are Naxclow Smart Doorbell X3, V720, X Smart Home, and ix cam. No specific firmware or version information is disclosed; all listed products are considered vulnerable.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available, suggesting no measured exploitation probability at present. Since the endpoint is externally reachable, the likely attack vector is remote HTTP or HTTPS requests. Because the attacker can enumerate identifiers, further attacks such as targeted disclosure or denial of service could be facilitated if the platform relies on these IDs for access controls. The vulnerability is not yet listed in CISA's KEV catalog.