CVE-2026-31849
Received Received - Intake
CSRF Vulnerability in Nexxt Nebula 300+ Firmware Allows Unauthorized Settings Changes

Publication date: 2026-03-23

Last updated on: 2026-04-29

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a result, an attacker can craft malicious web requests that are executed in the context of an authenticated administrator’s browser, leading to unauthorized configuration changes, including enabling services or modifying system settings.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-23
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-03-23
EPSS Evaluated
2026-06-15
NVD
CVE-2026-31849
EUVD
EUVD-2026-14417
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
nexxtsolutions nebula300plus_firmware to 12.01.01.37 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in Nexxt Solutions Nebula 300+ firmware versions up to 12.01.01.37, where there is no Cross-Site Request Forgery (CSRF) protection on state-changing administrative endpoints.

This means a remote attacker can trick an authenticated administrator into submitting crafted requests that change device settings without the administrator's knowledge or intent.

Impact Analysis

This vulnerability can allow an attacker to modify important device settings, including security-related configurations, by exploiting the lack of CSRF protections.

Such unauthorized changes could compromise the security and proper functioning of the device, potentially leading to further exploitation or loss of control.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31849. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart