EUVD-2026-89968
GHSA-vwxr-mxjc-x8m5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable MQTT/WebSocket path with no auth or UI; out-of-bounds read yields limited memory disclosure (C:L, contra vendor C:N) and a reliable crash (A:H).
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
6DescriptionCVE.org
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
AnalysisAI
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or compromised broker - or a man-in-the-middle on the WebSocket connection - crash the embedded network stack and potentially disclose a limited amount of adjacent memory. Affected builds are NetX Duo 6.4.4 through 6.5.1.202602, and only firmware that actually compiles in and uses the MQTT client over WebSocket is exposed; devices running plain MQTT/TCP or no MQTT are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target firmware/application to use the NetX Duo MQTT client over the WebSocket transport (the affected setter path); devices using plain MQTT/TCP, or not using MQTT at all, are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional availability risk rather than a top-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or exact fixed version is identified in the available input data, so the first step is to pull the current Eclipse ThreadX NetX Duo advisory at https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-hp64-f44f-wjw6 (and the EUVD entry EUVD-2026-89968 / NVD record CVE-2026-102717) to obtain the vendor-recommended fixed version and apply it as soon as it is published for your firmware baseline; until then the most effective compensating control is to compile out or disable the MQTT-over-WebSocket transport in NetX Duo and run MQTT over plain TCP with TLS instead - the trade-off is loss of browser-compatible connectivity, which matters if clients behind restrictive proxies depend on WebSocket port 443 traversal. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all firmware using Eclipse ThreadX NetX Duo versions 6.4.4 through 6.5.1.202602 and determine which builds compile in and actively use the MQTT-over-WebSocket client; where MQTT-over-WebSocket is not required, disable it or fall back to plain MQTT/TCP, and restrict broker connections to trusted endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Moquette MQTT brokers running versions prior to 0.18.1 fail to enforce topic write ACLs on Last Will and Testament messa
An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates
Improper TLS hostname validation in the MQTT client layer of AWS IoT Device SDK for Python (AWSIoTPythonSDK) 1.5.3 throu
Remote unauthenticated clients can crash a Moquette MQTT broker running 0.18.0 or earlier by publishing or subscribing w
Hardcoded MQTT credentials shipped inside Bransys ELD grant unauthenticated read access to real-time telemetry for every
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client
Loopback source-address restriction bypass in RabbitMQ's native MQTT and MQTT-over-WebSocket listeners (all releases fro
Authorization bypass in RabbitMQ's MQTT topic permission handling allows a low-privileged authenticated user to broaden
Authenticated users of FlashMQ MQTT brokers running versions prior to 1.23.2 can cause a gradual memory leak by creating
NanoMQ MQTT brokers prior to 0.24.14 can be driven unresponsive by a remote unauthenticated client that sends MQTT v5 PU
The NanoMQ MQTT client (versions prior to 0.24.14) can be hung and driven into a CPU- and memory-consuming infinite loop
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today