Lucene search

[email protected]CVE-2023-1748

HistoryApr 04, 2023 - 5:15 p.m.

CVE-2023-1748

2023-04-0417:15:07

CWE-798

[email protected]

web.nvd.nist.gov

nexx smart home

hard-coded credentials

unauthorized access

security vulnerability

mqtt server

garage door control

smart plug control

nvd

cve-2023-1748

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.2%

JSON

The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.

Affected configurations

NVD

Node

getnexxnxal-100Match-

AND

getnexxnxal-100_firmwareRange≤nxal100v-p1-9-1

Node

getnexxnxg-100bMatch-

AND

getnexxnxg-100b_firmwareRange≤nxg100bv-p3-4-1

Node

getnexxnxpg-100wMatch-

AND

getnexxnxpg-100w_firmwareRange≤nxpg100cv4-0-0

Node

getnexxnxg-200Match-

AND

getnexxnxg-200_firmwareRange≤nxg200v-p3-4-1

CPENameOperatorVersion
getnexx:nxal-100_firmwaregetnexx nxal-100 firmwarelenxal100v-p1-9-1

CPE	Name	Operator	Version
getnexx:nxal-100_firmware	getnexx nxal-100 firmware	le	nxal100v-p1-9-1

CNA Affected

[
  {
    "vendor": "Nexx",
    "product": "Smart Alarm NXAL-100",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "nxal100v-p1-9-1",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Nexx",
    "product": "Smart Plug NXPG-100W",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "nxpg100cv4-0-0",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Nexx",
    "product": "Garage Door Controller NXG-100B, NXG-200",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "nxg200v-p3-4-1",
        "versionType": "custom"
      }
    ]
  }
]