10
CVSSv3

CVE-2023-1748

Published: 04/04/2023 Updated: 07/11/2023
CVSS v3 Base Score: 10 | Impact Score: 6 | Exploitability Score: 3.9
VMScore: 0

Vulnerability Summary

The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

getnexx nxal-100_firmware

getnexx nxg-100b_firmware

getnexx nxpg-100w_firmware

getnexx nxg-200_firmware

Recent Articles

It's this easy to seize control of someone's Nexx 'smart' home plugs, garage doors
The Register

Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources Netizens urged to disconnect kit after 40,000-plus devices found riddled with dumb bugs

A handful of bugs in Nexx's smart home devices can be exploited by crooks to, among other things, open doors, power off appliances, and disable alarms. More than 40,000 of these gadgets in residential and commercial properties are said to be vulnerable after the manufacturer failed to act. After the Internet-of-Things biz reportedly ignored attempts over three months by Sam Sabetan, who discovered the vulnerabilities, and the US government's Cybersecurity and Infrastructure Security Agency (CISA...