Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in Naxclow devices, where a persistent, unchangeable relay credential can be obtained by attackers. If compromised, this credential allows for long-term impersonation or interception of device communications, even after resets. The primary concern is to confirm if your organization uses affected Naxclow devices and assess potential exposure.
- A permanent device secret can be stolen.
- Enables persistent spying or impersonation.
- Confirm Naxclow device usage and exposure.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by obtaining a device's persistent relay credential, which is re-issued on each boot and never rotates. If an attacker acquires this credential through any means, they can gain long-term access to the device's communication channel, enabling them to impersonate or intercept data. This access persists even after the device is reset or re-onboarded.
- Attacker obtains device's relay credential.
- Relayed communication channel is compromised.
- Persistent device impersonation or interception.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthorized party to gain persistent access to a Naxclow device's relay channel by obtaining its server-side relay credential. This credential, which is re-issued on each boot and never rotates, enables long-term impersonation or interception of device communications.
- Device relay channel access.
- Credential obtained through exposure.
- Persistent impersonation or interception.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
The Naxclow devices' persistent relay credential vulnerability requires immediate attention from teams responsible for critical infrastructure and network security. First, identify all deployed Naxclow devices, ascertain their network exposure and business criticality, and pinpoint the accountable system owners. Then, plan remediation actions based on the identified risk, which may involve coordinated efforts with the vendor.
- Owning teams: Infrastructure, Security, Vendor Management.
- Verify: Device exposure and business criticality.
- Action: Plan vendor-coordinated remediation.
