What’s Vulnerable › Vulnerabilities

CVE-2026-31849: Missing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-23 · updated 2026-06-17
• Weakness: CWE-352

Description

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a result, an attacker can craft malicious web requests that are executed in the context of an authenticated administrator’s browser, leading to unauthorized configuration changes, including enabling services or modifying system settings.

Affected products

• Nexxtsolutions Nebula300Plus Firmware: through 12.01.01.37

References

• https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip
• https://www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6/

Get alerted when CVE-2026-31849 or the next vulnerability affects your stack