The vulnerability lies in a registration endpoint that accepts signed requests containing a batch prefix and any caller‑supplied account identifier, yet fails to verify that the caller actually owns the specified account. Each call creates a new sequential device identifier and returns the current high‑water counter for the batch, revealing how many devices belong to that batch. Attackers can therefore enumerate the entire active device space by repeatedly submitting signed requests with fabricated account identifiers.

Affected products include Naxclow Smart Doorbell X3, Naxclow V720, Naxclow X Smart Home, and Naxclow ix cam. No specific version information is supplied by the CNA.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote network attacker sending signed requests to the registration endpoint over the device’s exposed interface. An attacker can enumerate device identifiers and potentially discover additional assets without performing privileged operations, creating a footprint for later exploitation.