The Nebula 300+ firmware uses an ecos_pw cookie that stores Base64‑encoded credential data with a static suffix. Because the encoding is reversible and the cookie lacks integrity checks, an attacker can create a valid cookie without authenticating. Submitting such a forged cookie allows the attacker to gain administrative access to protected endpoints, threatening confidentiality, integrity, and availability of the device.

All Nexxt Solutions Nebula 300+ units running firmware version 12.01.01.37 or earlier are vulnerable to this flaw. The issue is contained within the firmware of this product family and any installation with a version equal to or older than 12.01.01.37 must be examined.

The CVSS score of 8.7 rates this vulnerability as high. The EPSS of less than 1% indicates that exploitation is currently unlikely, and it is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can craft a valid ecos_pw cookie and send it to any reachable Nebula 300+ device, bypassing authentication without requiring local access or additional privileges.