IcscertCVELIST:CVE-2023-1748CVE-2023-1748 CVE-2023-1748
9.3 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
9.7 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
54.2%
The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.
CNA Affected
[
{
"vendor": "Nexx",
"product": "Smart Alarm NXAL-100",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "nxal100v-p1-9-1",
"versionType": "custom"
}
]
},
{
"vendor": "Nexx",
"product": "Smart Plug NXPG-100W",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "nxpg100cv4-0-0",
"versionType": "custom"
}
]
},
{
"vendor": "Nexx",
"product": "Garage Door Controller NXG-100B, NXG-200",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "nxg200v-p3-4-1",
"versionType": "custom"
}
]
}
]Related
9.3 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
9.7 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
54.2%