CVE-2026-31848

N/A

Description

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication. This allows unauthorized administrative access to protected endpoints.

CVE Details

CVSS v3.1 ScoreN/A

Published3/23/2026

Last Modified3/26/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-312

References

https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip(309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c)

https://www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6/(309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.