nvd-json-data-feeds/CVE-2023/CVE-2023-17xx/CVE-2023-1748.json

{
  "id": "CVE-2023-1748",
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "published": "2023-04-04T17:15:07.060",
  "lastModified": "2023-11-07T04:04:48.833",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the ability to remotely control garage doors or smart plugs for any customer."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0
      },
      {
        "source": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:getnexx:nxal-100_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "nxal100v-p1-9-1",
              "matchCriteriaId": "ECEB2E75-CBB4-4698-8362-E299B360D230"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:getnexx:nxal-100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A105A0A9-453D-4FEC-A892-90DF700AF48F"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:getnexx:nxg-100b_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "nxg100bv-p3-4-1",
              "matchCriteriaId": "CFED44C1-D08F-485F-9613-2FF354646544"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:getnexx:nxg-100b:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "19767CB6-01EC-4D9A-B879-622D97659C41"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:getnexx:nxpg-100w_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "nxpg100cv4-0-0",
              "matchCriteriaId": "705949CF-FA4F-4D31-A125-897E4738FD60"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:getnexx:nxpg-100w:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BABBFCE0-C690-4867-9416-5C9E453A6B1F"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:getnexx:nxg-200_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "nxg200v-p3-4-1",
              "matchCriteriaId": "5D3856AF-F315-4D54-A415-23D870E57FDC"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:getnexx:nxg-200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E23E0481-74FD-4F0C-926C-D303DF9F9E68"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-094-01",
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ]
    }
  ]
}