Description (CNA)
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Nexxt Solutions / Nebula 300+ | affected <= 12.01.01.37 |
CWE
CWE-312
References
- https://www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6/
- https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip
ADP enrichment
No English description supplied.
No references supplied.