title: CVE-2023-1751
description: The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which leak a deviceId.
problem types: CWE-20 Improper Input Validation
affected:
{
vendor: Nexx
product: Smart Alarm NXAL-100
versions:
status: affected, version: 0, lessThanOrEqual: nxal100v-p1-9-1, versionType: custom
}
{
vendor: Nexx
product: Smart Plug NXPG-100W
versions:
status: affected, version: 0, lessThanOrEqual: nxpg100cv4-0-0, versionType: custom
}
{
vendor: Nexx
product: Garage Door Controller NXG-100B, NXG-200
versions:
status: affected, version: 0, lessThanOrEqual: nxg200v-p3-4-1, versionType: custom
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
]