7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
27.3%
The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which leak a deviceId.
[
{
"vendor": "Nexx",
"product": "Smart Alarm NXAL-100",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "nxal100v-p1-9-1",
"versionType": "custom"
}
]
},
{
"vendor": "Nexx",
"product": "Smart Plug NXPG-100W",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "nxpg100cv4-0-0",
"versionType": "custom"
}
]
},
{
"vendor": "Nexx",
"product": "Garage Door Controller NXG-100B, NXG-200",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "nxg200v-p3-4-1",
"versionType": "custom"
}
]
}
]