https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-31851.htmlhttps://patchthecve.com/cve/CVE-2026-31851.htmlWed, 17 Jun 2026 10:34:37 +0000CRITICAL 9.8: Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that rely on credential validation, enabling brute-force attacks thttps://patchthecve.com/cve/CVE-2026-31850.htmlhttps://patchthecve.com/cve/CVE-2026-31850.htmlWed, 17 Jun 2026 10:34:37 +0000MEDIUM 4.9: Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative credentials and WiFi pre-shared keys, in plaintext within exported configuration backup files. These backup files can be obtained through legitimate functionality or other weaknesshttps://patchthecve.com/cve/CVE-2026-31849.htmlhttps://patchthecve.com/cve/CVE-2026-31849.htmlWed, 17 Jun 2026 10:34:37 +0000MEDIUM 6.5: Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a result, an attacker can craft malicious web requests that are executed in the context of an authentichttps://patchthecve.com/cve/CVE-2026-31848.htmlhttps://patchthecve.com/cve/CVE-2026-31848.htmlMon, 10 Aug 2026 12:17:15 +0000CRITICAL 9.8: Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cohttps://patchthecve.com/cve/CVE-2026-31847.htmlhttps://patchthecve.com/cve/CVE-2026-31847.htmlMon, 10 Aug 2026 12:17:15 +0000HIGH 8.8: Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activa