NetX Duo CVE-2026-103415

Exploitation requires the victim to run NetX Duo as a TLS 1.3 client that initiates an outbound handshake and to reach an attacker-controlled or MITM-intercepted server; the server triggers the bug by returning a HelloRetryRequest containing a cookie larger than the caller-supplied TLS packet buffer. No authentication or certificate is needed because the overflow happens before certificate authentication completes (consistent with PR:N). Limiting factors: only the client code path is vulnerable (TLS servers are unaffected), the target must negotiate TLS 1.3 and accept a HelloRetryRequest, and the attacker must hold the server side of a connection the device chooses to make rather than being able to reach the client unsolicited.

All available signals point to a genuine high-priority flaw. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VC:H/VI:H/VA:H yields a 9.3 Critical, and the CWE-787 out-of-bounds write occurs before certificate authentication completes, meaning a malicious or MITM TLS 1.3 server can corrupt memory on the client with no credentials and no valid certificate - a strong path toward remote code execution or denial of service on embedded targets. No EPSS probability, CISA KEV entry, or public POC was supplied in the input, so exploitation maturity is currently 'no public exploit identified at time of analysis' and real-world exploitation volume cannot be quantified from the data. The main nuance CVSS does not capture is that the attacker must occupy the server side of the connection the victim client initiates (a malicious endpoint the device is directed to, or a MITM position), rather than being able to spray arbitrary internet hosts; this makes the flaw high-severity but more targeted than a classic internet-facing server bug. Only the client path is affected, so pure server deployments of NetX Duo are not exposed.

An embedded or IoT device running NetX Duo opens an outbound TLS 1.3 connection and the attacker-controlled (or MITM-intercepted) server responds with a HelloRetryRequest carrying an oversized cookie. The client copies the peer-supplied cookie, whose length and contents it does not validate against the outgoing buffer, writing past the TLS packet buffer and corrupting adjacent memory before any certificate is checked. No public exploit code was identified in the provided data, but the AV:N/AC:L/PR:N profile makes reliable triggering straightforward for a server-side attacker.