Vulnerability · Published Mar 23, 2026 · Assigned by TuranSec

CVE-2026-31851Nexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force Attacks

High 7.7

In plain English

A high-severity security flaw in Nebula 300+ from Nexxt Solutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.3%top 71.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that rely on credential validation, enabling brute-force attacks to guess administrative credentials without restriction.

Affected products (as reported)

Vendor	Product	Versions
Nexxt Solutions	Nebula 300+	<= 12.01.01.37

Weakness: CWE-307 · Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.nexxtsolutions.com/connectivity/internal-products/ARN02304U6/ third-party-advisory
https://nexxt-connectivity-frontend.s3.amazonaws.com/media/docs/Nebula300+_v12.01.01.37.zip third-party-advisory