EUVD-2026-89195
GHSA-rqmh-m9w6-hv3m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated via malicious server (AV:N/AC:L/PR:N/UI:N), but a bounded over-read more plausibly yields limited memory leak (C:L) or a client crash (A:L) than full confidentiality.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
4DescriptionCVE.org
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a malicious or malformed server, and both have the same shape: the bounds check exists and returns the correct status, but it runs after the read it is meant to guard.
AnalysisAI
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through 6.5.1.202602 allow an attacker who controls or impersonates the TLS/DTLS server to make the client parse a truncated handshake message and read a few bytes past the end of the buffer. The flaw is reachable over the network with no authentication or user interaction in the CVSS vector (AV:N/AC:L/PR:N/UI:N), but it is only triggerable when a NetX Secure client initiates a handshake toward attacker-steered server infrastructure; devices that only connect to trusted or pinned servers are substantially less exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a device running Eclipse ThreadX NetX Duo (NetX Secure, version ≤6.5.1.202602) acting as a TLS or DTLS CLIENT, and the attacker must control or impersonate the SERVER that the client connects to (a malicious or malformed server, or a MITM position on the client's outbound handshake). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) describes a network-reachable, low-complexity, unauthenticated flaw, which on paper looks like a serious remote issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so treat the GitHub advisory GHSA-4q67-8385-j6m5 (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-4q67-8385-j6m5) as the authoritative source for the fixed NetX Duo release and upgrade to the first version it names; verify by hash and re-test the client handshake path after flashing, since these are embedded firmware images with no dynamic patching. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all products and devices using Eclipse ThreadX NetX Duo (NetX Secure) through 6.5.1.202602, identify any client-side TLS/DTLS handshakes to external or untrusted servers, and restrict outbound TLS/DTLS connections to approved, trusted, or pinned endpoints where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACK
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated re
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device,
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, perf
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server r
Eclipse NetX Duo's NetX Secure TLS stack accepts empty application-data records without ever generating or comparing the
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today