CVE-2026-42932
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Jun 12, 2026
CISA due date
—
The record
Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can be enumerated.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-64964 ATutor generates predictable email confirmation tokens due to the use of insufficiently… CWE-340
- CVE-2026-9219 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a… CWE-340
- CVE-2026-11374 In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit… CWE-340
- CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure… CWE-340
- CVE-2026-9692 Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids… CWE-340
- CVE-2026-45673 Netty is a network application framework for development of protocol servers and clients. CWE-340
- CVE-2026-8503 Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session… CWE-340
- CVE-2026-5084 WebDyne::Session versions through 2.075 for Perl generates the session id insecurely. CWE-340