by Kastro
Paper/Archive/CVE-2026-31848

CVE-2026-31848

Nexxt Solutions Nebula 300+ — Reversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
34
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 22.1.221 × 204.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication.

Affected

ProductAffectedFixed inSource
Nebula 300+<= 12.01.01.37–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
TuranSec (CNA)8.7CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupnexxtsolutions.com/connectivity/internal-products/ARN02304U6writeupnexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip