CVE-2023-1750

The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could retrieve device history, set device settings, and retrieve device information.

Score

CVSS 3.1 7.1 High

Status

Modified - ics-cert@hq.dhs.gov

Published

2023-04-04

Last modified

2025-01-16

Weaknesses

CWE-639

Affected products

• Nxal-100 Firmware (Getnexx)
• Nxg-100b Firmware (Getnexx)
• Nxg-200 Firmware (Getnexx)
• Nxpg-100w Firmware (Getnexx)
• Garage Door Controller Nxg-100b (Nexx)
• Nxg-200 (Nexx)
• Smart Alarm Nxal-100 (Nexx)
• Smart Plug Nxpg-100w (Nexx)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01