What’s Vulnerable › Vulnerabilities

CVE-2026-31851: Nexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force Attacks

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-23 · updated 2026-06-17
• Weakness: CWE-307

Description

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that rely on credential validation, enabling brute-force attacks to guess administrative credentials without restriction.

Affected products

• Nexxtsolutions Nebula300Plus Firmware: through 12.01.01.37

References

• https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip
• https://www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6/

Get alerted when CVE-2026-31851 or the next vulnerability affects your stack