The vulnerability arises from hidden functionality in the /goform/setSysTools endpoint of Nexxt Solutions Nebula 300+ firmware versions up to 12.01.01.37. An authenticated attacker can send a crafted POST request that turns on a Telnet service on port 23, exposing a privileged diagnostic interface that is meant for internal use only. This flaw constitutes a CWE‑912 vulnerability and effectively provides remote code execution or privileged command execution capabilities to anyone that can authenticate to the device.

This issue affects Nexxt Solutions Nebula 300+ devices running firmware versions 12.01.01.37 and earlier. The affected system is the Nebula 300+ network gateway, which typically serves as a local management point for connectivity infrastructure.

The vulnerability scores as CVSS 8.5, indicating high severity, while the EPSS score is below 1 %, implying current exploit prevalence is low and the vulnerability is not on the CISA Known Exploited Vulnerabilities list. Attackers need valid credentials to reach the endpoint, so the exploit requires prior access or credential compromise, but once authenticated, the attacker can activate Telnet with a simple POST request. The applied risk is elevated when the Nebula device is exposed to untrusted networks, as the enabled Telnet service opens a channel for arbitrary command execution.