CVE-2026-31846
Unauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
1th
Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. The endpoint returns a raw response containing parameters such as Login_PW, which is Base64-encoded. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.
| CWE | CWE-306 |
| Vendor | nexxt solutions |
| Product | nebula 300+ / tenda f3 v2.0 firmware |
| Published | Mar 23, 2026 |
| Last Updated | Mar 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for nexxt solutions nebula 300+ / tenda f3 v2.0 firmware
Be the first to know when new medium vulnerabilities affecting nexxt solutions nebula 300+ / tenda f3 v2.0 firmware are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Nexxt Solutions / Nebula 300+ / Tenda F3 V2.0 Firmware
<= 12.01.01.37
References
Credits
Angel Barre (call4pwn)