CVE-2023-1751

State: Published
Severity: 7.5 High
Published: Apr 4, 2023
Updated: Jan 16, 2025
Reserved: Mar 30, 2023

Description

The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which leak a deviceId.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	icscert

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Smart Alarm NXAL-100Nexx	nxal100v-p1-9-1 and earlierAffected
Smart Plug NXPG-100WNexx	nxpg100cv4-0-0 and earlierAffected
Garage Door Controller NXG-100B, NXG-200Nexx	nxg200v-p3-4-1 and earlierAffected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.