Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined wit…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 23, 2026 · NIST NVD

   Detected

   Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication.

2. Aug 10, 2026 · NIST NVD

   Updated

   Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication.

Affected

• cpe nexxtsolutions/nebula300plus firmwareversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-31848

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-31848

  Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct

  nvd.nist.gov

References

• Product · nexxt-connectivity-frontend.s3.amazonaws.com
• Product · nexxtsolutions.com