by Kastro
Paper/Archive/CVE-2023-1748

CVE-2023-1748

Nexx Smart Alarm NXAL-100 — CVE-2023-1748

EPSS 0.8%CVSS 10.0
critical.is priorityof 100
42
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 57.5.575 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.

Affected

ProductAffectedFixed inSource
Smart Alarm NXAL-100≤ nxal100v-p1-9-1–CNA
Smart Plug NXPG-100W≤ nxpg100cv4-0-0–CNA
Garage Door Controller NXG-100B, NXG-200≤ nxg200v-p3-4-1–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
icscert (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcisa.gov/news-events/ics-advisories/icsa-23-094-01