The firmware for Nexxt Solutions Nebula 300+ up to version 12.01.01.37 lacks any mechanism to limit the number of authentication attempts or lock accounts after repeated failures, creating a brute‑force vulnerability. An attacker who can reach the device’s credential validation endpoints can try an arbitrary number of username/password combinations, potentially discovering administrative credentials. This weakness is described by CWE‑307, which deals with missing or ineffective authentication rate‑limiting controls. The primary effect is the compromise of account confidentiality and integrity, as attackers may gain full administrative access without detection.

Known affected vendor is Nexxt Solutions, product Nebula 300+. All firmware releases up to and including version 12.01.01.37 are impacted. No other product or version information is listed. End‑points that use the device’s credential validation services are vulnerable.

The CVSS score is 7.7, indicating a high risk severity. The EPSS score is below 1 %, suggesting low overall exploitation likelihood in the general threat landscape, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a network‑based attempt against the device’s authentication interfaces, requiring an attacker to reach the device and provide credential inputs. If successful, the attacker can obtain administrative access and control over the entire Nebula 300+ installation.