CVE-2026-31846

MediumCVSS 6.5/10Last modified Aug 10, 2026

Description

Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
Nexxt SolutionsNebula 300+ / Tenda F3 V2.0 Firmware<= 12.01.01.37

References

Timeline

Published
Mar 23, 2026
Last modified
Aug 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-318478.8Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote eCVE-2026-318489.8Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded cCVE-2026-318496.5Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goCVE-2026-31855.3A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-messagCVE-2026-318504.9Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative credentials and WiFiCVE-2026-318519.8Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authenticCVE-2026-318529.8Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary coCVE-2026-318535.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9.13-41, an overflow CVE-2026-318548.8Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the modCVE-2026-318569.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability existsCVE-2026-318578.8Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 condiCVE-2026-318588.8Craft is a content management system (CMS). The ElementSearchController::actionSearch() endpoint is missing the unset() protection that was