EUVD-2026-89210
GHSA-mjm4-7228-hgjf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (eclipse) · only source for this CVE.
CVSS VectorVendor: eclipse
Lifecycle Timeline
3DescriptionCVE.org
NetX Duo's WebSocket client resets the unmasking cursor to the first NX_PACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet's unused payload area and on through the second packet's NX_PACKET control block.
The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.
AnalysisAI
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACKET control block structures via a maliciously crafted masked WebSocket frame, potentially leading to code execution or denial of service. The vulnerability, tracked as CVE-2026-102761 with a CVSS 4.0 score of 9.3, affects all versions of NetX Duo per the CPE. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Vulnerability AssessmentAI
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) presents this as a trivially exploitable, fully-remote, unauthenticated out-of-bounds write with full C/I/A impact - consistent with CWE-787 and the description's key point that the four-byte WebSocket masking key gives the attacker control over the bytes written (attacker-chosen NX_PACKET control-block corruption, not incidental). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Remediation | Vendor patch availability is not confirmed from the provided data; consult the GitHub Security Advisory GHSA-6xgx-v7gw-qjph for official remediation guidance and exact fix versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every product and firmware image that embeds Eclipse NetX Duo (all versions are affected per the CPE) and determine which of those expose the WebSocket client to untrusted or internet-adjacent traffic; tag those assets as high priority and notify product owners and the vendor that patch status is 'No vendor-released patch identified at time of analysis' so they can press for a fixed release timeline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated re
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device,
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, perf
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server r
Eclipse NetX Duo's NetX Secure TLS stack accepts empty application-data records without ever generating or comparing the
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today