Product Library / Garage & Access

Nexx Smart Wi-Fi Garage Door Controller (NXG-300)

Compiled by SmartHomeWorkflow Research · Nexx · Garage & Access · ~$80 ($79.99 on the vendor's own store at time of research, with an active cart. The two predecessor models named in the CISA advisory, NXG-100B and NXG-200, are sold out on the vendor's store.)

Compatibility

Protocols: WIFI · BLUETOOTH

Needs before it works: No hub — the controller joins 2.4 GHz Wi-Fi directly. Bluetooth is advertised on the NXG-300 page as 'New Bluetooth connectivity' and the vendor's blog claims the predecessor 'works with BLUETOOTH so that you can control your garage door even when the Internet is out'. TREAT THAT CLAIM AS THINLY DOCUMENTED: the FCC-filed NXG-300 quick-start guide does not mention Bluetooth at all, and the vendor publishes no specification for its range, whether it is phone-proximity only, or whether it carries status as well as trigger. All of that is UNKNOWN. Every ecosystem integration routes through the vendor's cloud; no local or LAN API is documented.

Subscription reality

✓ Works without a subscription: Yes.

No subscription was found for any function. Noted for completeness rather than as a selling point — the material facts about this product are in the security and safety sections below, not in its pricing model.

Maintenance reality

• Batteries: The controller is mains-powered. The wireless tilt sensor is battery-powered; no vendor battery-life figure was located.
• Cloud dependence: Yes — a server shutdown would degrade or brick this device
• Fully cloud-dependent. The vendor's FAQ states the app 'communicates through the cloud with your Nexx devices', and there is no documented local API, LAN control, or local HTTP/MQTT endpoint. If the vendor's cloud were shut down, all app, voice, scheduling and remote functions would stop, and no migration path is documented. The vendor's 'Cloud Error Issue' support article prescribes fixing your timezone and re-logging in, and never explains what survives an outage — so outage behaviour beyond the undocumented Bluetooth claim is UNKNOWN. The physical wall button and existing RF remotes always keep working, which follows structurally from the wiring method rather than from a vendor statement. DOOR POSITION comes from a wireless TILT sensor, Velcro-mounted to the top of the door — the FCC-filed guide's pairing procedure, moving the sensor from vertical to horizontal, is definitive for a tilt sensor. The vendor confirms its limitation: 'Wireless sensor detects up/down motion only' — binary open or closed, with no partial position. An optional wired close-limit sensor also exists.

The catch

There is an open United States government security advisory covering this product line, and the vendor never engaged with it. CISA published ICSA-23-094-01 on 2023-04-04, covering five vulnerabilities in Nexx devices. The most severe, CVE-2023-1748, is universal hard-coded credentials retrievable with a single API request — scored 9.3 by CISA and 10.0 by NVD — which allowed a remote attacker to open any customer's garage door. The researcher first contacted Nexx on 2023-01-04 and received no reply at any point before publishing three months later. Nexx did act afterwards: on 2023-04-07 it emailed customers announcing a security update rolling out by April 10, and said it had disabled device internet connectivity to address the issue. WHAT NOBODY HAS EVER ESTABLISHED IS WHETHER THAT FIXED ANYTHING. CISA's advisory has never been revised and still reads 'Nexx has not responded to requests to work with CISA to mitigate these vulnerabilities.' All five CVEs remain listed at NVD with no patch reference, no vendor advisory reference, and no fixed-version boundary. Nexx has published no security bulletin and no firmware changelog, and no researcher, journalist or agency has re-tested in the three years since. Two further facts a buyer should have: the hard-coded credentials were reported to live in both the firmware and the mobile app, and the iOS app has not been updated since December 2021 — so no iOS-side update has ever removed them, though the server-side flaws could have been fixed silently. And the two other products named in that same advisory, the Smart Plug NXPG-100W and the Smart Alarm NXAL-100, are still listed for sale today — the two garage models CISA named are the two that are now sold out. None of this appears anywhere on the vendor's site, which markets the product's encryption in superlative terms and links to US-based cloud servers. SEPARATELY, AND ON A DIFFERENT AXIS ENTIRELY: federal rule requires an audible and visual warning before any unattended close, and Nexx publishes an official tutorial for switching its warning beep OFF — a mandatory safety function shipped as a user preference. No visual warning component is evidenced at all. The safety documentation has also gone backwards over the product line's life: the older NXG-100 manual carries a proper installation-warning page, and the NXG-200 and NXG-300 manuals dropped it, leaving a single generic line.

Who it's for

Anyone considering this needs to weigh one thing that no specification sheet carries: a federal advisory covering this product line remains open, the vendor is recorded in it as not having responded, no fix has ever been publicly confirmed by any independent party, and the vendor is still selling other products named in that same advisory. A buyer who is comfortable proceeding would need to be satisfied without any way to verify whether the unit they receive is remediated, because the vendor has published nothing that would let them check. On the functional side, setting the security question aside entirely: it is a cloud-dependent controller with no Apple Home support, no Home Assistant path, no Matter, an Alexa integration that cannot participate in Routines, and an iOS app frozen since 2021 at a 1.76-star rating. Households on Alexa or Google who want a straightforward cloud controller have several alternatives in this category at similar or lower prices without an open advisory attached. We are recording this product because the advisory is a documented public fact that a buyer will not find on the vendor's own pages, not because we have tested it.

Sources & method

Retrieved in full from cisa.gov (WebFetch returned 403; a direct fetch succeeded), released 2023-04-04, covering NXG-100B and NXG-200 plus the Smart Plug and Smart Alarm. Five CVEs: CVE-2023-1748 (hard-coded credentials), CVE-2023-1749, CVE-2023-1750, CVE-2023-1751, CVE-2023-1752. CVE-2023-1748 is scored 9.3 by CISA and 10.0 at NVD — the two authorities differ and both figures are recorded rather than picking one. — regulator-source research, verified 2026-07-19 · Researcher Sam Sabetan's own writeup establishes first contact 2023-01-04 and public release 2023-04-04 with no reply at any point. CISA's advisory independently records that Nexx did not respond to coordination attempts. Both are primary to their respective authors. — researcher and regulator source research, verified 2026-07-19 · On 2023-04-07 Nexx emailed customers announcing 'a system update to the following product devices to enhance their security and performance: Nexx Garage (all models), Nexx Gate (all models), and Nexx Plug', rolling out that day and completing by 2023-04-10 'if not earlier', and stating 'We had to disable the device internet connection to address this issue'. VERIFICATION CHECKS, ALL NEGATIVE as of 2026-07-19: CISA's advisory shows only the 2023-04-04 release date with no Update A/B revision markers and its mitigations section still reads 'Nexx has not responded to requests to work with CISA to mitigate these vulnerabilities'; all five CVEs at NVD remain vulnStatus Modified, last modified 2026-06-17; reference tags on all five are only Third Party Advisory and US Government Resource, with no Patch and no Vendor Advisory tag; no CPE range on any of the five carries a versionEndExcluding, so NVD records no version at which the flaw ceases. No Nexx security bulletin or firmware changelog was found, and no independent re-test by any researcher, journalist or agency was found in three years. RECORDED DELIBERATELY as 'no confirmed fix' rather than 'unpatched', because asserting a remediated product was unpatched would be a serious error in the other direction. Note in fairness that CVE-2023-1749 through -1752 are server-side and could have been remediated silently. — regulator and NVD research; explicit fairness check, verified 2026-07-19 · Domain getnexx.com active, created 2019-02-21, updated 2026-01-17, expires 2027-02-21, status ok. Storefront live and functional with an active cart. ANDROID app Nexx Home v3.11.1.14 updated 2026-01-26. iOS app Nexx Home v3.8.2.3 last updated 2021-12-03, rating 1.76 from 205 ratings. Legal entity SimpalTEK LLC confirmed via both app stores, FCC grantee code 2AN5L, and three registered trademarks. THIS CORRECTS THE BRIEF'S PREMISE: 'vendor abandonment' is too blunt — a company shipping Android builds in 2026 is not defunct. The accurate characterisation is selective neglect plus non-engagement: an active seller that maintains one platform, left the other frozen since before the vulnerabilities were reported, and never answered a researcher, a federal agency or the press. UNKNOWN: Texas entity standing (Comptroller lookup is a session-gated POST returning 302) and current support responsiveness (JS-rendered review widget) — both recorded as observed live, viability unverified. — registry, app-store and WHOIS research; premise corrected, verified 2026-07-19 · All THREE FCC-filed manuals were read directly — NXG-100 (2AN5LNXG-100R), NXG-200 (2AN5LNXG200) and NXG-300 (2AZD7NXG-300). A keyword sweep across all three for 'UL 325', '1211', 'audible', 'alarm', 'unattended', 'remote clos' and 'flash' returned zero substantive hits: no §1211.14(f) marking, no reference to 16 CFR 1211, and no documented audible-and-visual pre-close warning sequence. THE SHARPER FINDING, which is stronger than an absence: Nexx publishes an official tutorial titled 'Nexx Home App: Enable or Disable Garage Opener Beep Warning Sound' (March 2021), and its support material states the app 'allows you to choose if your garage door should play a warning sound when activated or not'. 16 CFR 1211 §1211.14 makes the warning MANDATORY, not a user preference — a warning shipped as a toggle the owner can switch off does not meet a mandatory requirement regardless of its default state. Warning hardware does exist (the manual documents pairing beeps: 2 entering pairing, 3 on success, one 2-second beep on failure), but NO visual warning component is evidenced anywhere — the only lights are Power, WiFi and Activity status LEDs on the unit body, inside the garage, which is not a warning lamp. A DOCUMENTATION REGRESSION worth recording: the OLDEST model has the MOST safety documentation. The NXG-100 manual carries a proper installation-warning page ('Nexx Garage and any door sensors are meant to be used with garage door openers that are equipped with photoelectric safety sensors (manufactured after 1993)' plus 'NEVER operate the remote access feature of your Nexx Garage without ensuring that it is safe to do so'), and the newer NXG-200 and NXG-300 manuals DROPPED that page entirely, leaving one line: 'SAFETY WARNING: Make sure the garage door does not get obstructed by any child, person, or object.' STATED WITHOUT OVERREACH: no teardown or firmware analysis was performed, so the beep's duration, its timing relative to door movement, and its default state are all UNKNOWN, and retail packaging was not photographed. This is a documented gap plus a documented defeatable control, NOT a finding of regulatory non-compliance. — regulatory-filing and vendor-documentation research; limits stated, verified 2026-07-19 · Two independent signals. FIRST, the FCC grantee changed: every earlier Nexx model was filed by SimpalTEK LLC itself (grantee code 2AN5L), while the NXG-300 was filed under 2AZD7 — CherryEmme Technologies Co. Ltd of Hong Kong, granted 2021-03-29 — which is the signature of moving from in-house design to a contract manufacturer. SECOND, and unambiguous: the NXG-300's own user manual repeatedly refers to the NXG-200, with step headings reading '6. CHECK STATUS OF NXG-200' and '7. ADD NXG-200 TO NEXX HOME'. It is the NXG-200 document with the title swapped and the body left uncorrected. The same manual contains mangled customer-facing links ('gotnexx.Bm/dwck', 'support@getnexx.Bm') that would not work if typed. PRACTICAL CONSEQUENCE FOR THE SECURITY QUESTION: the NXG-300 is the only garage model still purchasable and the only one NOT named in CISA's advisory — but if it is the NXG-200 design re-sourced to an ODM, its absence from the advisory is a technicality of enumeration rather than evidence it was ever fixed. All grant dates were verified against two independent sources (fccid.io and fcc.report) because fccid.io initially showed application and grant dates as identical. — regulatory-filing and vendor-manual research, verified 2026-07-19 · The Texas Comptroller's public Active Franchise Taxpayers dataset (data.texas.gov/resource/9cir-efmm.json, rows updated 2026-07-18) lists SIMPALTEK LLC with status A (Active) and right to transact business A (Active), taxpayer number 32060503383, charter date 2016-05-16, at an address matching the FCC grantee record exactly. Cloud infrastructure is up (api.nexxhome.com and home.nexxhome.com both return HTTP 200) and the store transacts. NO acquisition, bankruptcy, insolvency or discontinuation reporting was found. RECORDED EXPLICITLY BECAUSE 'DEFUNCT' WOULD BE FACTUALLY WRONG and indefensible. What the evidence supports instead is a single-maintainer skeleton operation: the Android app shipped 2026-01-26 while the iOS app has been untouched since 2021-12-03 at 1.8 stars; the YouTube channel linked in Nexx's own site footer is CONFIRMED DEAD ('This channel does not exist'); the Facebook page appears deleted, which is meaningful rather than a login wall because Facebook group content loaded un-authenticated in the same session; there is no phone support, only email; no BBB profile exists across three searches; and the parent's own domain simpaltek.com is a dead Shopify store. Also confirmed: the two garage models named in CISA's advisory (NXG-200, NXG-100B) now report available:false, while the Smart Plug NXPG-100 and Smart Alarm NXAL-100 — also named in that advisory — remain purchasable. — state-registry, app-store and infrastructure research; framing corrected, verified 2026-07-19 · csa-iot.org/csa-iot_products/ was searched for 'nexx' twice, once with Matter and product-type filters and once unfiltered. Both loaded successfully and returned 'No Entries Found — Please try adjusting your selected filters.' A blocked search does not produce that message. Nexx makes no Matter or Thread claim on its own product page either. — registry research, verified 2026-07-19 · From the FCC-filed NXG-300 quick-start guide: the compatibility test instructs the installer to 'put each end to the same terminals where your wall button wires are terminated to. By doing so, your garage door should activate', and installation is to 'twist together each wire of the wall button to each of Nexx's connection' with 'It does not matter which wires goes to which terminals'. So it is a momentary dry-contact relay wired in parallel with the existing wall button, polarity-agnostic. WHAT IS NOT ESTABLISHED: Nexx publishes NO statement anywhere naming Security+ 2.0, Security+ 3.0, learn-button colours or myQ, and its compatibility page is a dropdown lookup with no published static list. A Nexx adapter (NXAD-200) exists and the vendor states some openers 'will only work with Nexx Garage Adapter', which fits the pattern of digital-serial wall controls defeating a plain contact closure — but that reasoning is mechanism-level inference plus third-party adapter evidence, NOT a Nexx claim, and is flagged as such. — regulatory-filing research; inference flagged as inference, verified 2026-07-19 · Three queries against saferproducts.gov/RestWebServices/Recall — RecallTitle=Nexx, ProductName=Nexx and RecallDescription=Nexx — each returned an empty array, while a control query for ProductName=garage returned 8 records (Chamberlain myQ 2023, Loctek, Eagle, H.E., Genie, Lennox, Chamberlain 1997, Stanley 1991), none of them Nexx. So the negative is real. METHODOLOGY CAVEAT THAT SHOULD TRAVEL TO FUTURE RECORDS: this API's ManufacturerName parameter DOES NOT FILTER — it returned an identical 9,905-record dump for 'Nexx', for 'SimpalTEK', and for the nonsense control string 'ZZZZQQQQNOTREAL'. Any result obtained through that parameter is meaningless and must not be cited. Note also that the absence of a recall is NOT evidence of safety: a recall requires CPSC action, and consumer incident reports could not be checked because the CPSC public incident database exposes no REST endpoint. — regulator-API research with control and negative control, verified 2026-07-19 · smarthomeexplorer.com/guides/best-smart-garage-door-openers-2026 claims a CNET rating of 8.2/10 for the NXG-300 and quotes CNET as saying it 'responds to voice commands faster than any other single-controller garage opener in this price range'. NO CNET review of this product could be found at all; the quote and the score appear invented. The same page presents a '7.8/10 Consensus' aggregated from '21 trusted sources including Wirecutter, CNET, PCMag, Consumer Reports', none of which could be verified as having reviewed it, and recommends the product in a 2026 buying guide with NO mention of the CISA advisory or the five CVEs — the single most decision-relevant fact about it. Also rejected: manuals.plus serves an NXG-300 'manual' page contaminated with a different product's content, listing All-O-Matic support contacts and describing RADIO/COMMON terminal wiring — the FCC filing was used instead. BOT-WALLED and unreachable: cisa.gov via WebFetch (403, resolved by direct fetch), Amazon Alexa skill store pages (500 on all attempts), and Google's works-with directory listing. — source-quality audit, verified 2026-07-19. This is a research profile: compiled from manufacturer documentation, certification registries, and published testing — we state facts, not verdicts, and we have not physically tested this unit. How we work →

Compatibility and lifecycle information reflects the last-verified date above and can change without notice (firmware updates, cloud-service changes, discontinuations). It is provided as-is, for information — verify with the manufacturer before purchasing. Spot an error? Tell us and we'll fix it. Full terms: Terms of Service.

Check it against YOUR setup →