CVE-2023-1748: Getnexx Nxal-100 Information Disclosure Flaw

CVE-2023-1748 Overview

CVE-2023-1748 is a critical hardcoded credentials vulnerability affecting multiple Nexx Smart Home devices, including garage door controllers and smart plugs. The affected firmware contains hard-coded credentials that allow an attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware to view these credentials and access the MQ Telemetry Server (MQTT) server. This access enables remote control of garage doors or smart plugs belonging to any Nexx customer, presenting severe physical security implications.

Critical Impact

Attackers can remotely control garage doors and smart plugs for any Nexx customer by exploiting hard-coded credentials exposed in the mobile application or device firmware, potentially enabling unauthorized physical access to homes and properties.

Affected Products

• Getnexx NXAL-100 (Smart Alarm) and Firmware
• Getnexx NXG-100B (Smart Garage Controller) and Firmware
• Getnexx NXPG-100W (Smart Plug) and Firmware
• Getnexx NXG-200 (Smart Garage Controller) and Firmware

Discovery Timeline

• April 4, 2023 - CVE-2023-1748 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-1748

Vulnerability Analysis

This vulnerability falls under CWE-798 (Use of Hard-coded Credentials), a critical security flaw where authentication credentials are embedded directly in the firmware or application code. The Nexx Smart Home ecosystem relies on MQTT protocol for device communication and control. By embedding static credentials in the mobile application and device firmware, the vendor inadvertently exposed the authentication mechanism to reverse engineering and extraction.

The impact extends beyond individual devices because the hard-coded credentials provide access to the centralized MQTT server infrastructure. An attacker does not need physical access to the target device—network access to the MQTT server using the extracted credentials is sufficient to enumerate and control devices belonging to other customers. This represents a complete bypass of the intended authorization model.

Root Cause

The root cause of CVE-2023-1748 is the use of hard-coded credentials embedded in both the Nexx Home mobile application and the affected device firmware. Instead of implementing per-device or per-user authentication tokens, the developers used shared static credentials for MQTT server authentication across the entire product line. This design decision means that extracting credentials from a single device or application instance grants access to the entire customer base.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker can extract the hard-coded credentials through multiple methods:

1. Mobile Application Analysis: Reverse engineering the Nexx Home mobile application to extract embedded MQTT credentials from the application binary or configuration files.

2. Firmware Extraction: Dumping the firmware from any affected Nexx device and analyzing it to locate the embedded credentials.

3. Network Traffic Analysis: Capturing MQTT traffic between the mobile application and the server to observe the authentication credentials being transmitted.

Once credentials are obtained, the attacker connects directly to the Nexx MQTT server and can enumerate connected devices, subscribe to device status topics, and publish control commands to operate garage doors or smart plugs for any customer on the platform.

Detection Methods for CVE-2023-1748

Indicators of Compromise

• Unexpected MQTT connections from unknown IP addresses to the Nexx cloud infrastructure
• Unusual garage door or smart plug activations at irregular times without user initiation
• Multiple device control commands originating from a single connection session targeting different customer accounts
• Authentication logs showing connections with the known hard-coded credentials from non-registered devices

Detection Strategies

• Monitor network traffic for MQTT protocol communications to Nexx server endpoints from unexpected sources
• Implement anomaly detection for device control patterns, flagging commands occurring outside normal usage hours
• Review mobile application logs for evidence of reverse engineering tools or unauthorized API access attempts
• Deploy network intrusion detection signatures for known Nexx MQTT server endpoints

Monitoring Recommendations

• Enable logging on home network firewalls to track outbound connections from Nexx devices to identify unusual communication patterns
• Configure alerts for garage door or smart plug state changes via secondary monitoring systems independent of Nexx infrastructure
• Periodically audit network traffic from IoT devices for unexpected connection destinations
• Consider network segmentation to isolate smart home devices from critical home network resources

How to Mitigate CVE-2023-1748

Immediate Actions Required

• Disconnect affected Nexx devices from the network until a firmware update with proper authentication is available
• Monitor physical security of areas controlled by affected garage door controllers manually
• Review any unexplained garage door or smart plug activity logs for signs of unauthorized access
• Contact Nexx support to inquire about firmware updates or remediation options

Patch Information

At the time of this vulnerability disclosure, users should consult the CISA ICS Advisory ICSA-23-094-01 for official remediation guidance and any vendor-issued patches. The fundamental fix requires Nexx to implement per-device or per-user authentication credentials and remove the hard-coded credentials from both the mobile application and device firmware.

Workarounds

• Physically disconnect Nexx garage door controllers and use manual operation until the vulnerability is addressed
• Replace affected Nexx smart plugs with alternative products from vendors that do not use hard-coded credentials
• If continued use is necessary, implement network-level restrictions limiting Nexx device communications to known endpoints only
• Consider using a dedicated IoT network segment with enhanced monitoring to limit exposure

Due to the nature of this vulnerability (hard-coded credentials in firmware), there is no configuration-based mitigation that fully addresses the risk. The credentials cannot be changed by end users, and the only complete remediation is a firmware update from Getnexx that implements proper per-device authentication mechanisms.