CVE-2026-31848CWE-312

CVE-2026-31848

Critical · published March 23, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00479 · 40.4th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-03-23T17:16Z
Affected products (1)
ProductVersionsFixed in
nexxtsolutions/nebula300plus_firmware≤ 12.01.01.37—
References (2)
https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6/ · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 23 MAR 12:09Z
    Reversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+
    cvelistv5