Angel Barre

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37 **Description** A flaw exists that allows an unauthenticated attacker to retrieve sensitive device information, including the administrator password. The issue is present in the `/goform/ate` API endpoint. A crafted HTTP request to this endpoint returns a response containing parameters such as `Login PW`, which is Base64-encoded. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device. Successful exploitation allows an adjacent attacker to obtain the administrator password. The recovered credential can be used to authenticate to the device and may facilitate further compromise. **Recommendations** Versions prior to 12.01.01.37 should be updated.

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37 **Description** A hidden functionality within the `/goform/setSysTools` endpoint allows remote activation of a Telnet service. Enabling this service exposes a privileged diagnostic management interface over the network, expanding the attack surface and potentially leading to further compromise of the device. The vulnerable endpoint is `/goform/setSysTools`. **Recommendations** Versions prior to 12.01.01.38 should be updated.

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37 **Description** The device stores administrative credentials within the `ecos pw` cookie using a reversible Base64 encoding with a static suffix. Obtaining or deriving this cookie allows an attacker to forge a valid administrative session and gain unauthorized access to the device. **Recommendations** Update to a version later than 12.01.01.37.

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37 **Description** The Nexxt Solutions Nebula 300+ firmware does not have Cross-Site Request Forgery (CSRF) protections on administrative endpoints that change the device’s state. An attacker can make an authenticated administrator unintentionally submit requests to modify device settings, including security configurations. The affected endpoints allow modification of device settings without the administrator’s knowledge. **Recommendations** Update to a version beyond 12.01.01.37.

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37 **Description** The firmware stores sensitive information, including administrative credentials and WiFi pre-shared keys, in plaintext within exported configuration backup files. **Recommendations** Versions prior to 12.01.01.38 should not be used.

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37 **Description** The authentication interface of Nexxt Solutions Nebula 300+ firmware does not enforce rate limiting or account lockout mechanisms. This allows for potential brute-force attacks against the authentication system. **Recommendations** Update to a version beyond 12.01.01.37.