PatchTheCVEnebula300plus firmware vulnerabilities and fixes
Recent CVEs affecting nebula300plus firmware, with upgrade or downgrade steps. 5 tracked.
Also searched as: nebula300plusfirmware.
nebula300plus firmware has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-03-23. Highest priority: CVE-2026-31851 (score 46/100).
- CVE-2026-31848 CRITICAL 9.8 UPGRADE Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, w
- CVE-2026-31847 HIGH 8.8 UPGRADE Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through versi
- CVE-2026-31851 CRITICAL 9.8 UPGRADE Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account l
- CVE-2026-31850 MEDIUM 4.9 UPGRADE Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including admin
- CVE-2026-31849 MEDIUM 6.5 UPGRADE Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-
FAQ
How do I fix nebula300plus firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nebula300plus firmware being exploited right now?
None of the tracked nebula300plus firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nebula300plus firmware CVE should I patch first?
CVE-2026-31851 currently ranks highest (46/100): Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account l.