CVE-2023-1748: CVE-2023-1748

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-04 · updated 2026-06-17
Weakness: CWE-798

Description

The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.

Affected products

Getnexx Nxal-100 Firmware: through nxal100v-p1-9-1
Getnexx Nxg-100B Firmware: through nxg100bv-p3-4-1
Getnexx Nxg-200 Firmware: through nxg200v-p3-4-1
Getnexx Nxpg-100W Firmware: through nxpg100cv4-0-0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01
https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01

Get alerted when CVE-2023-1748 or the next vulnerability affects your stack