CVE-2026-31851 is a critical authentication flaw in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37, scored 9.8. The router has no rate limiting or account lockout, so an attacker can try passwords without limit. I could not confirm a fixed version.
What's affected
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37, per the NVD record. No fixed version is named in the record or its references, which are the vendor's product page and a firmware package.
How to check if you're exposed
Log in to the router's administration page and read the firmware version on the status or system page. Anything up to 12.01.01.37 is in scope per the record. I could not confirm a fixed firmware version, so check the vendor's product page for newer firmware before you plan the upgrade.
Then check exposure. If the router's web administration is reachable from the internet, that is the first thing to close, whatever the firmware says.
What to do now
- Look for newer firmware on the vendor's page and apply it.
- Make sure the administration page is not exposed to the internet.
- Set a long, unique administrator password, since guessing is the whole attack.
- Watch for repeated failed logins in the router's logs if it keeps any.
Why it matters
The class is CWE-307, improper restriction of excessive authentication attempts. Without a delay or lockout, a script can try thousands of passwords an hour. Strong passwords hold up well against that, and default or short ones do not.
The score of 9.8 assumes the admin page is reachable over the network. Where it is only reachable from inside a home or office LAN, the real risk is lower. That is why closing remote admin is the most useful single step.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Does a strong password solve this?
It makes guessing impractical, but it does not fix the missing lockout. Closing remote access matters too.
Sources
Last reviewed: 19 October 2026.
