Naxclow’s onboarding workflow flaw lets an attacker replay a confirm‑then‑bind sequence, silently transferring device ownership to an arbitrary account. An attacker who already has any Naxclow account can hijack the device without the user’s knowledge.

The flaw affects Naxclow Smart Doorbell X3, V720, X Smart Home, and ix cam devices. No specific firmware or software version ranges are published, so all current releases of these models remain potentially vulnerable.

The CVSS score of 8.7 marks the issue as high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack can be carried out remotely by any logged‑in account that can submit the exploit requests; no special local access or privileges are required. The attacker can reuse the same ownership credentials to silently re‑associate an already online device with the target account.