CVE-2023-1751 CVE-2023-1751
Authorized users can access alarm data from other devices due to missing bearer token validation in the WebSocket server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1751?
CVE-2023-1751 is a high-severity missing authorization vulnerability in Nexx Garage Door Controller NXG-100B, NXG-200, published on 4 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which leak a deviceId.
Which versions are affected by CVE-2023-1751?
It affects 4 products.
Products include Getnexx Nxal-100 Firmware, Getnexx Nxg-100b Firmware, Getnexx Nxg-200 Firmware, Getnexx Nxpg-100w Firmware.
How do I fix CVE-2023-1751?
No fix has been published for CVE-2023-1751 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-1751 being exploited?
There is no known exploitation of CVE-2023-1751 in the wild and no public exploit code.
Other vulnerabilities in Nexx Garage Door Controller NXG-100B, NXG-200
Sources
Also known as GHSA-8j4q-8455-qxw3.