During Wi‑Fi association, the device firmware writes the host network’s SSID, PSK, and negotiated WPA keys to an exposed UART console that drops into an interactive shell permitting arbitrary memory reads. This is a CWE‑538 vulnerability—Insertion of sensitive information into an externally accessible device. An attacker with brief physical access, such as a passer‑by of an exterior‑mounted doorbell, can intercept those clear‑text credentials and read the entire firmware image, giving them full control of the device. The result is disclosure of confidential network information and the ability to launch firmware‑based attacks.

The affected devices are Naxclow Smart Doorbell X3, Naxclow V720, Naxclow X Smart Home, and Naxclow ix cam. No specific firmware versions are listed, so all current production hardware with the exposed UART console is potentially vulnerable.

The CVSS score of 5.1 indicates moderate severity; the EPSS score is currently unavailable, and the vulnerability has not yet been listed in CISA’s KEV catalog. An attacker requires limited physical access to the UART console, which is reasonable for outdoor‑mounted IoT devices. Because a shell is exposed, a successful exploitation path can yield arbitrary memory reads and full firmware extraction. In the absence of an official patch, the risk remains moderate but is likely targeted by attackers seeking network credentials or device control.