CVE-2023-1748

State: Published
Severity: 9.3 Critical
Published: Apr 4, 2023
Updated: Jan 16, 2025
Reserved: Mar 30, 2023

Description

The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L	icscert

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Smart Alarm NXAL-100Nexx	nxal100v-p1-9-1 and earlierAffected
Smart Plug NXPG-100WNexx	nxpg100cv4-0-0 and earlierAffected
Garage Door Controller NXG-100B, NXG-200Nexx	nxg200v-p3-4-1 and earlierAffected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.