EUVD-2026-89191
GHSA-5fpf-ww23-crjj
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent L2 attacker (AV:A) sends an unauthenticated (PR:N) crafted frame with no interaction; OOB read faults the stack yielding availability-only impact (A:H), no confidentiality or integrity.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
AnalysisAI
Out-of-bounds reads in Eclipse NetX Duo's MSRP (Multiple Stream Reservation Protocol) attribute-list parser allow an attacker positioned on the same layer-2 network segment to crash a device by supplying a malformed attribute list whose length field is never validated. The flaw affects NetX Duo builds that have the MSRP / TSN-AVB stream-reservation feature compiled in and actively processing MSRP traffic; because exploitation requires adjacent-network access and yields only a denial of service - no confidentiality or integrity impact, and no code execution is claimed - this is a bounded availability issue rather than a remotely exploitable high-severity defect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to be on the same adjacent L2 network segment as the target (AV:A), and requires the device to have the MSRP / Multiple Stream Reservation Protocol (stream-reservation / TSN-AVB) feature compiled in and actively participating so it will parse incoming MSRP attribute lists (AT:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability issue, not a top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix described in the vendor's GitHub Security Advisory GHSA-m9hv-hvwf-5qh7 (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-m9hv-hvwf-5qh7); the available input does not specify an exact patched version, so confirm the fixed NetX Duo release in that advisory and reflash affected devices rather than assuming a version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACK
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated re
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device,
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, perf
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server r
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today