Angel Barre

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37 **Description** A flaw exists that allows an unauthenticated attacker to retrieve sensitive device information, including the administrator password. The issue is present in the `/goform/ate` API endpoint. A crafted HTTP request to this endpoint returns a response containing parameters such as `Login PW`, which is Base64-encoded. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device. Successful exploitation allows an adjacent attacker to obtain the administrator password. The recovered credential can be used to authenticate to the device and may facilitate further compromise. **Recommendations** Versions prior to 12.01.01.37 should be updated.

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ versions prior to 12.01.01.38 **Description** Hidden functionality in the '/goform/setSysTools' endpoint allows an authenticated attacker to remotely enable a Telnet service on port 23. This is achieved by sending a crafted POST request using the `telnetManageEn` and `telnetPwd` parameters. Once activated, the service exposes a privileged diagnostic management interface over the network, increasing the attack surface and potentially leading to further device compromise. **Recommendations** Update Nexxt Solutions Nebula 300+ to a version newer than 12.01.01.37. Restrict access to the '/goform/setSysTools' endpoint to minimize the risk of unauthorized service enablement.

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ versions prior to 12.01.01.38 **Description** Administrative authentication material is stored in the `ecos pw` cookie using a Base64-encoded format with a static suffix. Since Base64 is a reversible encoding scheme and the cookie lacks integrity protection, an attacker who obtains or derives this value can reconstruct or forge a valid administrative session to gain unauthorized access to the device. **Recommendations** Update to a version newer than 12.01.01.37.

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37 **Description** The Nexxt Solutions Nebula 300+ firmware does not have Cross-Site Request Forgery (CSRF) protections on administrative endpoints that change the device’s state. An attacker can make an authenticated administrator unintentionally submit requests to modify device settings, including security configurations. The affected endpoints allow modification of device settings without the administrator’s knowledge. **Recommendations** Update to a version beyond 12.01.01.37.

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37 **Description** The firmware stores sensitive information, including administrative credentials and WiFi pre-shared keys, in plaintext within exported configuration backup files. **Recommendations** Versions prior to 12.01.01.38 should not be used.

**Name of the Vulnerable Software and Affected Versions** Nexxt Solutions Nebula 300+ firmware versions through 12.01.01.37 **Description** The authentication interface of Nexxt Solutions Nebula 300+ firmware does not enforce rate limiting or account lockout mechanisms. This allows for potential brute-force attacks against the authentication system. **Recommendations** Update to a version beyond 12.01.01.37.