CVE-2023-1748

Back Back to CVE browser

CRITICAL

Published Apr 4, 2023

10.0

CRITICAL

CVSS 3.1

EPSS 0.83%

Description

The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.

Affected products

Vendor Nexx Product Garage Door Controller NXG-100B, NXG-200 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=nxg200v-p3-4-1
Vendor Nexx Product Smart Alarm NXAL-100 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=nxal100v-p1-9-1
Vendor Nexx Product Smart Plug NXPG-100W Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=nxpg100cv4-0-0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nexx

Garage Door Controller NXG-100B, NXG-200

n/a

Version	Status	Constraints
0	affected	<=nxg200v-p3-4-1

Nexx

Smart Alarm NXAL-100

n/a

Version	Status	Constraints
0	affected	<=nxal100v-p1-9-1

Nexx

Smart Plug NXPG-100W

n/a

Version	Status	Constraints
0	affected	<=nxpg100cv4-0-0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-23969
Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01
Third Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-23969		Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01		Third Party AdvisoryUS Government Resource