CVE-2023-1749 - OpenCVE

The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Getnexx	Nxpg-100w Nxg-100b Nxpg-100w Firmware Nxg-100b Firmware Nxg-200 Nxal-100 Firmware Nxal-100 Nxg-200 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:getnexx:nxal-100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:getnexx:nxal-100:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:getnexx:nxg-100b_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:getnexx:nxg-100b:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:getnexx:nxpg-100w_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:getnexx:nxpg-100w:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:getnexx:nxg-200_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:getnexx:nxg-200:-:*:*:*:*:*:*:*

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01	Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2023-04-04T16:54:46.115Z

Updated: 2023-04-04T16:54:46.115Z

Reserved: 2023-03-30T20:02:11.282Z

Link: CVE-2023-1749

JSON object: View

NVD Information

Status : Modified

Published: 2023-04-04T17:15:07.117

Modified: 2023-11-07T04:04:49.060

Link: CVE-2023-1749

JSON object: View

Redhat Information

No data.

CWE

CWE-639

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:getnexx:nxal-100_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ECEB2E75-CBB4-4698-8362-E299B360D230", "versionEndIncluding": "nxal100v-p1-9-1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:getnexx:nxal-100:-:*:*:*:*:*:*:*", "matchCriteriaId": "A105A0A9-453D-4FEC-A892-90DF700AF48F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:getnexx:nxg-100b_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CFED44C1-D08F-485F-9613-2FF354646544", "versionEndIncluding": "nxg100bv-p3-4-1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:getnexx:nxg-100b:-:*:*:*:*:*:*:*", "matchCriteriaId": "19767CB6-01EC-4D9A-B879-622D97659C41", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:getnexx:nxpg-100w_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "705949CF-FA4F-4D31-A125-897E4738FD60", "versionEndIncluding": "nxpg100cv4-0-0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:getnexx:nxpg-100w:-:*:*:*:*:*:*:*", "matchCriteriaId": "BABBFCE0-C690-4867-9416-5C9E453A6B1F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:getnexx:nxg-200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D3856AF-F315-4D54-A415-23D870E57FDC", "versionEndIncluding": "nxg200v-p3-4-1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:getnexx:nxg-200:-:*:*:*:*:*:*:*", "matchCriteriaId": "E23E0481-74FD-4F0C-926C-D303DF9F9E68", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute."}], "id": "CVE-2023-1749", "lastModified": "2023-11-07T04:04:49.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2023-04-04T17:15:07.117", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "nvd@nist.gov", "type": "Primary"}]}