Description
The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Nexx | Smart Alarm NXAL-100 | ≤ nxal100v-p1-9-1 | — |
| Nexx | Smart Plug NXPG-100W | ≤ nxpg100cv4-0-0 | — |
| Nexx | Garage Door Controller NXG-100B, NXG-200 | ≤ nxg200v-p3-4-1 | — |
Advisories 1
- ICSA-23-094-01 Nexx Smart Home Device CISA ICS & IT advisories · Apr 4, 2023