title: CVE-2023-1748
description: The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer.
problem types: CWE-798 Use of Hard-coded Credentials
affected:
{
vendor: Nexx
product: Smart Alarm NXAL-100
versions:
status: affected, version: 0, lessThanOrEqual: nxal100v-p1-9-1, versionType: custom
}
{
vendor: Nexx
product: Smart Plug NXPG-100W
versions:
status: affected, version: 0, lessThanOrEqual: nxpg100cv4-0-0, versionType: custom
}
{
vendor: Nexx
product: Garage Door Controller NXG-100B, NXG-200
versions:
status: affected, version: 0, lessThanOrEqual: nxg200v-p3-4-1, versionType: custom
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
baseScore: 9.3
baseSeverity: CRITICAL
]