A security researcher recently disclosed several vulnerabilities in Nexx smart devices that could allow an attacker to control garage doors, disable home alarms, and access sensitive information.

The five security issues range in severity from medium to critical, and the vendor has yet to acknowledge and fix them. The most significant vulnerability discovered is the use of hardcoded universal credentials in the firmware, which are also easily accessible from the client communication with Nexx’s API.

Overview of Nexx vulnerabilities

Independent researcher Sam Sabetan published a writeup detailing the security flaws in Nexx smart devices, affecting the Nexx Garage Door Controllers NXG-100B and NGX-200, the Nexx Smart Plug NXPG-100W, and the Nexx Smart Alarm NXAL-100.

Sabetan discovered five vulnerabilities, including the use of hardcoded credentials, improper access control on API requests, improper input validation, and improper authentication control.

Universal credentials used in firmware pose a severe security risk

The most severe of the five vulnerabilities is CVE-2023-1748, caused by Nexx Cloud setting a universal password for all newly registered devices.

This password is available on both the API data exchange and the firmware shipped with the devi