Vulnerability Description
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a result, an attacker can craft malicious web requests that are executed in the context of an authenticated administrator’s browser, leading to unauthorized configuration changes, including enabling services or modifying system settings.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nexxtsolutions | Nebula300Plus Firmware | <= 12.01.01.37 |
| Nexxtsolutions | Nebula300Plus | - |
Related Weaknesses (CWE)
References
- https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.0Product
- https://www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6/Product
FAQ
What is CVE-2026-31849?
CVE-2026-31849 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a r...
How severe is CVE-2026-31849?
CVE-2026-31849 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-31849?
Check the references section above for vendor advisories and patch information. Affected products include: Nexxtsolutions Nebula300Plus Firmware, Nexxtsolutions Nebula300Plus.