PT-2026-27116 · Nexxt Solutions · Nebula 300+

Angel Barre · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-31849

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37

Description The Nexxt Solutions Nebula 300+ firmware does not have Cross-Site Request Forgery (CSRF) protections on administrative endpoints that change the device’s state. An attacker can make an authenticated administrator unintentionally submit requests to modify device settings, including security configurations. The affected endpoints allow modification of device settings without the administrator’s knowledge.

Recommendations Update to a version beyond 12.01.01.37.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-31849

Affected Products

Nebula 300+

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-31849 · Security Note
• https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip · Note
• https://nexxtsolutions.com/connectivity/internal-products/ARN02304U6 · Note
• https://twitter.com/VulmonFeeds/status/2036134782187274368 · Twitter Post