CVE-2026-31846CWE-306

CVE-2026-31846

Medium · published March 23, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-03-23T16:16Z
References (2)
https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6/ · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 23 MAR 12:00Z
    Unauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+
    cvelistv5