Nexxtsolutions vulnerabilities
We track 4 vulnerabilities in Nexxtsolutions products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on March 23, 2026.
Latest Nexxtsolutions vulnerabilities
- 9.8 Critical severity
Nebula 300+: Improper Restriction of Excessive Authentication Attempts
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that rely on credential va
- 9.8 Critical severity
Nebula 300+: Cleartext Storage of Sensitive Information
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an atta
- 8.8 High severity
Nebula 300+: Hidden Functionality
Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetP
- 8.8 High severity
Amp300 Firmware: Improper Neutralization of Special Elements used in an OS Command
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required