Security concerns after device highjacked.

10megaton
10megaton Posts: 3  Freshman Member
First Comment
in Nebula

I have two nwa50ax pro access points registered in Nebula. As I am away for a few days I left one powered off and the other online.

Today I discovered that somehow the access point that was left on has been highjacked and configured with many open wifi networks allowing unrestricted access to my LAN (see attachment).

How the hell is this possible? Even if someone has the details on the bottom of the access point (QR, MAC, serial) how can they add it to an alternative nebula account without being on the same LAN as the the access point itself?

As I now have no faith in Nebula security I have powered off both devices until Zyxel can explain what has happened.

This is terrible security and totally unfit for use.

IMG-20250608-WA0001.jpg

All Replies

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,235  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula

    Hi @10megaton ,

    The Nebula mobile app includes a feature that allows users to register access points using the Nebula QR code over the internet, without requiring a local network connection. This is a Nebula feature that enables users to register and manage your Nebula devices anywhere, anytime. This functionality serves two main purposes:

    1. Users don't need to manually enter the MAC address and serial number when the device is in unregistered status.
    2. Users can register previously used devices even when the original owner forgets to unregister the device from their account.

    We also provide a feature that allows users to prevent other users from scanning their device's Nebula QR code to register the device, addressing security concerns.

    For your case, it appears that someone has used your NWA50AX PRO's Nebula QR code to register your access point to their account. If you have the NWA50AX PRO device with the QR code, you can deregister the AP using the NCC Mobile App. For step-by-step instructions on this process, please refer to Part 1 of this FAQ.

    How to register Access Point to Nebula — Zyxel Community

    After deregistering the device, follow the steps outlined in this guide to prevent unauthorized device ownership override by other users.

    How to prevent device ownership override by other user — Zyxel Community

    Zyxel_Judy

  • PeterUK
    PeterUK Posts: 3,808  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited 4:50AM

    Maybe someone knows you login to Nebula?

    check if any other IP has logged in

    Zyxel Nebula - Recent logins

    I'm not sure if someone knows your wifi password they can then config your AP when in Nebula by standalone? or may be the AP reset to defaults which would of made it open?

  • 10megaton
    10megaton Posts: 3  Freshman Member
    First Comment

    Thank you did the reply.

    When I try to re-register the device on the Nebula portal I get the "this device is locked by the device owner" error.

    Also the prevent device override should be the default behaviour for security reasons. It's madness that anyone with the details can take over the device by default.

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,235  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    edited 9:13AM

    Hi @10megaton ,

    To better assist you, please check the community inbox for further discussion.

    Note that: Other users just can register your device if they have the device's Nebula QR code and you haven't enabled the feature to prevent device ownership override by other users.

    Zyxel_Judy

Categories

Nebula Tips & Tricks


    Read more

    Nebula Help Center

    EnglishTiếng ViệtРусскийไทย中文（台灣）