Unauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+
Summary
| CVE | CVE-2026-31846 |
|---|---|
| State | PUBLISHED |
| Assigner | TuranSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-03-23 12:16:07 UTC |
| Updated | 2026-08-10 12:17:15 UTC |
| Description | Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device. |
Risk And Classification
Primary CVSS: v4.0 7.1 HIGH from 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002500000 probability, percentile 0.163670000 (date 2026-08-10)
Problem Types: CWE-306 | CWE-306 CWE-306 Missing Authentication for Critical Function
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | Secondary | 7.1 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7.1 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| 3.1 | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 6.5 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | Secondary | 6.1 | AV:A/AC:L/Au:N/C:C/I:N/A:N | |
| 2.0 | CNA | CVSS | 6.1 | AV:A/AC:L/Au:N/C:C/I:N/A:N |
CVSS v4.0 Breakdown
Attack Vector
AdjacentAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
NoneAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
AdjacentAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
NoneAvailability
NoneAV:A/AC:L/Au:N/C:C/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Nexxt Solutions | Nebula 300 / Tenda F3 V2.0 Firmware | affected <= 12.01.01.37 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6 | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | www.nexxtsolutions.com | |
| nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | nexxt-connectivity-frontend.s3.amazonaws.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Angel Barre (call4pwn) (en)
There are currently no legacy QID mappings associated with this CVE.