medium6.5
CVE-2023-1749
The listed versions of Nexx Smart Home devices lack proper access control when executing actions.
Impact
The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Getnexx | Nxal-100 Firmware | through nxal100v-p1-9-1 |
| Getnexx | Nxg-100b Firmware | through nxg100bv-p3-4-1 |
| Getnexx | Nxpg-100w Firmware | through nxpg100cv4-0-0 |
| Getnexx | Nxg-200 Firmware | through nxg200v-p3-4-1 |