Eclipse NetX Duo CVE-2026-102715

Requires the device to be running the NetX Duo mDNS responder addon (addons/mdns/nxd_mdns.c) and answering _http._tcp service queries. The attacker must be on the same LAN / link-local segment (adjacent network, AV:A - not routable across the internet) and sends two ordinary mDNS PTR responses whose owner-name lengths both fall within one rounded string-table bucket (e.g. 12, 13, 14 or 15 characters, which round to the same 4-byte-aligned slot). No authentication and no user interaction are needed (PR:N/UI:N). Limiting factors: adjacency requirement confines the attack to the local segment; the mDNS addon must be compiled in and active; and the overflow is bounded to 1-3 bytes, so in a normal packet pool the realistic effect is packet/pool corruption and DoS rather than a controllable code-execution primitive.

This is a genuine but bounded risk. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H, base 7.1) is internally consistent with the description: exploitation requires only adjacent-network (LAN/link-local) reach, no authentication, no user interaction, and low complexity - any host on the local segment can send two crafted mDNS PTR responses. Impact is correctly scoped to availability-high plus low-integrity with NO confidentiality (this is a pure out-of-bounds WRITE of 1-3 attacker-influenced bytes, not a read), so this is not an information-disclosure bug despite the memory-corruption class. No EPSS score, no CISA KEV listing, and no public exploit are provided, so this is 'no public exploit identified at time of analysis'. The absence of KEV/EPSS is expected for a freshly-published vendor self-report and does not lower intrinsic risk, but it does mean there is no evidence of active or automated exploitation. The realistic ceiling is degraded: the overflow lands in the next packet within the same pool (no ASAN-style redzone in production), so the practical outcome is a corrupted neighbouring packet or corrupted pool free-list - denial of service / instability rather than a clean, reliable RCE primitive, which is why availability (VA:H) dominates and integrity is only Low. Net: a real MED-priority issue for exposed embedded/IoT devices running the mDNS responder, not an internet-wide critical.

An attacker with a foothold on the same LAN segment as a NetX Duo device (e.g. a compromised IoT device or laptop on the corporate/home Wi-Fi) issues an mDNS query for _http._tcp and then sends two crafted PTR responses whose owner-name lengths both fall in the same rounded 12-15 character bucket. The responder reuses the first name's stored pointer for the second record and writes 1-3 bytes past nx_packet_data_end, corrupting the adjacent packet or the pool free list and typically destabilizing or crashing the networking stack. No authentication or user interaction is required, but no public exploit code exists at time of analysis.