CVE-2026-31848 is a critical authentication flaw in Nexxt Solutions Nebula 300+ router firmware through version 12.01.01.37, scored 9.8. The ecos_pw cookie holds reversibly encoded credential data, so it can be rebuilt or forged. I could not confirm a fixed version, so check the vendor.
What's affected
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37, per the NVD record. The record lists both the nebula300plus device and its firmware.
The record names no fixed version, and the references are the vendor's product page and a firmware package for 12.01.01.37. Check the vendor's page for anything newer.
How to check if you're exposed
Log in to the router's administration page and read the firmware version on the status or system page. Anything up to 12.01.01.37 is in scope per the record. I could not confirm a fixed firmware version, so check the vendor's product page for newer firmware before you plan the upgrade.
Then check exposure. If the router's web administration is reachable from the internet, that is the first thing to close, whatever the firmware says.
What to do now
- Check the vendor's product page for firmware newer than 12.01.01.37 and install it when it exists.
- Turn off remote administration from the internet and limit the admin page to a trusted internal address.
- Change the administrator password, and do not reuse it elsewhere, since the cookie carries credential data.
- If no fix is available and the device sits at the edge of a sensitive network, plan to replace it.
Why it matters
The class is CWE-312, cleartext storage of sensitive information. The cookie holds Base64 encoded credential data plus a static suffix. Base64 is an encoding, not encryption, so anyone who sees the cookie can read what it contains, and with no integrity protection they can also build one that looks valid.
A login cookie should be a random session identifier that the server looks up, not a wrapper around the credentials. Home and small office routers often get this wrong, and they sit at the edge of the network, so a weak admin session there matters more than on an ordinary device.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Is there a patch?
I could not confirm one. The NVD record names versions through 12.01.01.37 as affected and gives no fixed version. Check the vendor's page.
What is the safest interim step?
Make sure the admin interface is not reachable from the internet and change the admin password.
Sources
Last reviewed: 19 October 2026.
