PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31846 Nexxt Solutions CVE debrief

A missing authentication vulnerability in Nexxt Solutions Nebula 300+ wireless routers allows adjacent unauthenticated attackers to retrieve administrative credentials. The /goform/ate endpoint returns device configuration data including a Base64-encoded administrator password (Login_PW parameter) without requiring authentication. Successful exploitation grants full administrative access to the device. The vulnerability affects firmware through version 12.01.01.37. The CVSS 4.0 vector indicates attack from adjacent network (AV:A), low attack complexity (AC:L), no privileges required (PR:N), and high confidentiality impact (VC:H). The root cause is classified as CWE-306: Missing Authentication for Critical Function.

Vendor
Nexxt Solutions
Product
Nebula 300+ / Tenda F3 V2.0 Firmware
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-23
Original CVE updated
2026-05-19
Advisory published
2026-03-23
Advisory updated
2026-05-19

Who should care

Network administrators managing Nexxt Solutions Nebula 300+ deployments, security teams responsible for wireless infrastructure, and organizations with these devices in guest or semi-trusted network segments where adjacent network attackers may be present.

Technical summary

The /goform/ate endpoint on Nexxt Solutions Nebula 300+ wireless routers (firmware ≤12.01.01.37) lacks authentication controls, allowing any adjacent network attacker to retrieve device configuration parameters. The response includes Login_PW, a Base64-encoded string containing the administrative password. Decoding this value provides valid credentials for device authentication. The vulnerability requires no user interaction and can be exploited with standard HTTP requests. Attack complexity is low with high confidentiality impact.

Defensive priority

HIGH

Recommended defensive actions

  • Restrict network access to Nexxt Solutions Nebula 300+ management interfaces to trusted administrative segments only
  • Monitor for unauthorized requests to /goform/ate endpoint on affected devices
  • Apply firmware updates from Nexxt Solutions when available; verify version exceeds 12.01.01.37
  • Rotate administrative credentials on affected devices after patching
  • Segment IoT and wireless infrastructure devices from production networks to limit adjacent network attack surface
  • Review device logs for evidence of prior unauthorized access to configuration endpoints

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Vendor identification derived from reference URLs pointing to Nexxt Solutions domain and S3-hosted firmware documentation. CVSS vector and CWE classification obtained from NVD metadata. Firmware version boundary confirmed through reference documentation link.

Official resources

2026-03-23