This vulnerability (CWE-306) exists due to the absence of authentication controls on the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37. An unauthenticated attacker within adjacent network range can access this endpoint to extract sensitive information, notably the administrator password. The attacker can then decode the password and authenticate to the device, potentially gaining full administrative control. The CVSS 4.0 base score is 7.1, reflecting high severity with attack vector as adjacent network, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

An attacker with adjacent network access can retrieve and decode the administrator password from the vulnerable endpoint, enabling unauthorized administrative access to the device. This compromises device confidentiality and control, potentially allowing full device takeover.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict network access to the device's management interfaces to trusted users only and monitor for suspicious activity on the /goform/ate endpoint.