PT-2023-2620 · Nexx · Nexx Garage Door Controller+2

Published 2023-04-04 · Updated 2023-04-12 · CVE-2023-1749

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Nexx Garage Door Controller versions NXG-100B, NXG-200 Nexx Smart Plug version NXPG-100W Nexx Smart Alarm version NXAL-100

Description The issue is related to a lack of proper access control when executing actions on Nexx Smart Home devices. An attacker with a valid deviceId could send API requests that the affected devices would execute, allowing for the execution of arbitrary commands. This could be done remotely.

Recommendations For Nexx Garage Door Controller versions NXG-100B, NXG-200, restrict access to API endpoints until a patch is available. For Nexx Smart Plug version NXPG-100W, avoid using the deviceId in API requests until the issue is resolved. For Nexx Smart Alarm version NXAL-100, consider disabling API execution for actions until a fix is provided. As a temporary workaround, consider restricting the use of API requests on all affected devices until a patch is available.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2023-02460

CVE-2023-1749

Affected Products

Nexx Garage Door Controller

Nexx Smart Alarm

Nexx Smart Plug

References · 8

• https://osv.dev/vulnerability/CVE-2023-1749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1749 · Security Note
• https://bdu.fstec.ru/vul/2023-02460 · Security Note
• https://t.me/cvenotify/47507 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-094-01 · Note
• https://t.me/cvenotify/48115 · Telegram Post
• https://t.me/cibsecurity/61411 · Telegram Post
• https://t.me/echeloneyes/1394 · Telegram Post