CVE-2026-31846

Description

Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. The endpoint returns a raw response containing parameters such as Login_PW, which is Base64-encoded. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.

References

https://www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6/

https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS