CVE-2026-31851 describes an improper restriction of excessive authentication attempts in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37. The firmware does not implement rate limiting or account lockout on authentication endpoints, allowing an attacker to perform unlimited brute-force attempts to guess administrative credentials. This vulnerability is classified under CWE-307 and has a CVSS 4.0 base score of 7.7, indicating high severity. There is no information on available patches or fixes from the vendor, and no known exploits in the wild have been reported.

The lack of rate limiting or account lockout mechanisms enables attackers to conduct brute-force attacks against authentication interfaces, potentially leading to unauthorized administrative access if credentials are guessed successfully. This could compromise device security and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external protections such as network-level access controls or monitoring for unusual authentication attempts to reduce risk.