Do Son CISA warns of 7 Naxclow IoT vulnerabilities, including a hard-coded key (CVE-2026-28742) enabling device takeover of doorbells and cameras.
Hard-Coded Key
A critical flaw in Apache StreamPark uses a hard-coded encryption key and the insecure AES ECB mode, risking data decryption and JWT authentication token forgery. Update to v2.1.7 immediately.
Apache warned of a Critical flaw (CVE-2025-65998) in Syncope. When AES is enabled for password storage, a hard-coded key allows attackers with database access to decrypt all user passwords. Update immediately.