CVEvulnerability

CVE-2023-1751

5.3 MEDIUM Published 2023-04-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-04-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which leak a deviceId.

Affected configurations

• getnexx nxal-100 firmware (<= nxal100v-p1-9-1) • getnexx nxg-100b firmware (<= nxg100bv-p3-4-1) • getnexx nxpg-100w firmware (<= nxpg100cv4-0-0) • getnexx nxg-200 firmware (<= nxg200v-p3-4-1)

References