CVE-2026-31848

CRITICAL 9.8CVE-2026-31848 · Published 23/03/2026 · updated 10/08/2026

In short

CVE-2026-31848 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.29%, higher than 22.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication.

References

nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip · Product
nexxtsolutions.com/connectivity/internal-products/ARN02304U6 · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free