Nebula300plus Firmware vulnerabilities

3 known vulnerabilities in Nebula300plus Firmware from Nexxtsolutions. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Nebula 300+: Improper Restriction of Excessive Authentication Attempts

  CVE-2026-31851Mar 23, 2026Nexxt Solutions

  Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that rely on credential va

• 9.8 Critical severity

  Nebula 300+: Cleartext Storage of Sensitive Information

  CVE-2026-31848Mar 23, 2026Nexxt Solutions

  Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an atta

• 8.8 High severity

  Nebula 300+: Hidden Functionality

  CVE-2026-31847Mar 23, 2026Nexxt Solutions

  Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetP