PT-2023-2623 · Nexx · Nexx Garage Door Controller+3

Published 2023-04-04 · Updated 2023-04-12 · CVE-2023-1752

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Nexx Smart Home devices (affected versions not specified) Nexx Garage Door Controller (NXG-100B, NXG-200) Nexx Smart Plug (NXPG-100W) Nexx Smart Alarm (NXAL-100)

Description The issue is related to weaknesses in the authentication procedure of Nexx Smart Home devices. This could allow any user to register an already registered alarm or associated device with only the device’s MAC address.

Recommendations For Nexx Smart Home devices, consider restricting access to device registration until a patch is available. For Nexx Garage Door Controller, Nexx Smart Plug, and Nexx Smart Alarm, avoid using the device registration feature with only the device’s MAC address until the issue is resolved. As a temporary workaround, consider disabling device registration for already registered alarms or associated devices until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-02463

CVE-2023-1752

Affected Products

Nexx Garage Door Controller

Nexx Smart Alarm

Nexx Smart Home

Nexx Smart Plug

References · 7

• https://osv.dev/vulnerability/CVE-2023-1752 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1752 · Security Note
• https://bdu.fstec.ru/vul/2023-02463 · Security Note
• https://t.me/echeloneyes/1394 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-094-01 · Note
• https://t.me/cibsecurity/61409 · Telegram Post
• https://t.me/cvenotify/47504 · Telegram Post