The vulnerability allows an attacker with a valid platform request signature to query device relay registration details and extract persistent credentials for arbitrary devices. By using these credentials, the attacker can register on the device relay as the legitimate device, enabling interception of communications and potential disruption of device operation. The weakness is a missing authorization check, classified as CWE‑862, and can compromise both confidentiality and integrity of device data.

The affected products are Naxclow Smart Doorbell X3, V720, X Smart Home, and ix cam, all running on the Naxclow IoT platform. Specific software versions are not disclosed in the available data.

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS is not available, but the CVE is not listed in the CISA KEV catalog. An attacker must possess a valid request signature; the likely attack vector is remote API access, where the attacker submits a signed request to the vulnerable endpoint and can retrieve device credentials.