PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31846 Nexxt Solutions CVE debrief

A missing authentication vulnerability in Nexxt Solutions Nebula 300+ wireless routers allows adjacent unauthenticated attackers to retrieve administrative credentials. The /goform/ate endpoint returns device configuration data including a Base64-encoded administrator password (Login_PW parameter) without requiring authentication. Successful exploitation grants full administrative access to the device. The vulnerability affects firmware through version 12.01.01.37. The CVSS 4.0 vector indicates attack from adjacent network (AV:A), low attack complexity (AC:L), no privileges required (PR:N), and high confidentiality impact (VC:H). The root cause is classified as CWE-306: Missing Authentication for Critical Function.

Vendor
Nexxt Solutions
Product
Nebula 300+ / Tenda F3 V2.0 Firmware
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-23
Original CVE updated
2026-08-10
Advisory published
2026-03-23
Advisory updated
2026-08-10

Who should care

Network administrators managing Nexxt Solutions Nebula 300+ deployments, security teams responsible for wireless infrastructure, and organizations with these devices in guest or semi-trusted network segments where adjacent network attackers may be present.

Technical summary

The /goform/ate endpoint on Nexxt Solutions Nebula 300+ wireless routers (firmware ≤12.01.01.37) lacks authentication controls, allowing any adjacent network attacker to retrieve device configuration parameters. The response includes Login_PW, a Base64-encoded string containing the administrative password. Decoding this value provides valid credentials for device authentication. The vulnerability requires no user interaction and can be exploited with standard HTTP requests. Attack complexity is low with high confidentiality impact.

Defensive priority

HIGH

Recommended defensive actions

  • Restrict network access to Nexxt Solutions Nebula 300+ management interfaces to trusted administrative segments only
  • Monitor for unauthorized requests to /goform/ate endpoint on affected devices
  • Apply firmware updates from Nexxt Solutions when available; verify version exceeds 12.01.01.37
  • Rotate administrative credentials on affected devices after patching
  • Segment IoT and wireless infrastructure devices from production networks to limit adjacent network attack surface
  • Review device logs for evidence of prior unauthorized access to configuration endpoints

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Vendor identification derived from reference URLs pointing to Nexxt Solutions domain and S3-hosted firmware documentation. CVSS vector and CWE classification obtained from NVD metadata. Firmware version boundary confirmed through reference documentation link.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31846 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31846

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31846 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31846

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

  • Source reference

    Unverified legacy reference

    URL: https://www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6/

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.