The vulnerability in Nexxt Solutions Nebula 300+ firmware (<=12.01.01.37) involves the ecos_pw authentication cookie containing Base64-encoded credential data combined with a static suffix. Because Base64 encoding is reversible and there is no integrity protection, an attacker can decode, reconstruct, or forge a valid cookie value to bypass authentication controls. This cleartext storage of sensitive information (CWE-312) exposes the device to unauthorized access risks. No patch or remediation information is provided in the available data.

An attacker can bypass authentication by reconstructing or forging the ecos_pw cookie, potentially gaining unauthorized access to the device. This compromises the confidentiality and integrity of the authentication mechanism, leading to high-impact security risks such as unauthorized device control or data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to trusted users and monitor for suspicious activity related to authentication cookies. Avoid relying on the ecos_pw cookie for authentication in untrusted environments.