Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-31850

Plaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative credentials and WiFi pre-shared keys, in plaintext within exported configuration backup files. These backup files can be obtained through legitimate functionality or other weaknesses and do not apply encryption or hashing, allowing attackers to directly extract sensitive information.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+ Nebula300plus Nebula300plus Firmware
CVE-2026-31849

Missing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a result, an attacker can craft malicious web requests that are executed in the context of an authenticated administrator’s browser, leading to unauthorized configuration changes, including enabling services or modifying system settings.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+ Nebula300plus Nebula300plus Firmware
CVE-2026-31848

Reversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+ Nebula300plus Nebula300plus Firmware
CVE-2026-31847

Hidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+

Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activate a Telnet service on port 23.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+ Nebula300plus Nebula300plus Firmware
CVE-2026-31846

Unauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+

Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+
CVE-2026-31851

Nexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force Attacks

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that rely on credential validation, enabling brute-force attacks to guess administrative credentials without restriction.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+ Nebula300plus Nebula300plus Firmware