NetX Duo CVE-2026-115403

Requires a build with NX_BSD_ENABLE, NX_BSD_RAW_SUPPORT and FEATURE_NX_IPV6, where the application sends on an AF_INET6 raw socket with IP_RAW_IPV6_HDRINCL set. The destination must be off the link and not yet in the destination table, the default router's neighbour cache entry must be unknown (e.g. a router added via nxd_ipv6_default_router_add that never sent a Neighbor Advertisement, or whose cache entry was deleted), and the destination table must be full (or the neighbour cache unable to take the next hop). A remote sender can fill the table with ICMPv6 Packet Too Big messages only when NX_ENABLE_IPV6_PATH_MTU_DISCOVERY is enabled; otherwise the table fills from the device's own traffic to distinct off-link destinations. Limiting factors: exploitation is gated on the application's own non-default raw-socket sending behaviour and on an unresolved default router - conditions the remote attacker does not control (hence AT:P) - so this is not reliably triggerable against an arbitrary default configuration.

Signals point to a real but bounded denial-of-service issue, not a top-tier emergency. The vendor CVSS 4.0 base score is 8.2 (High), but the impact metrics are strictly availability (VA:H with VC:N/VI:N) - there is no confidentiality or integrity exposure and no code execution; the worst outcome is a crash of the thread sending on the raw socket. The vector carries AT:P (attack requirements present), and the advisory explains why: the crash also needs the application itself to send a raw IPv6 packet with its own header to a new off-link destination while the default router is unresolved, and the remote sender controls none of that - so a lone attacker cannot deterministically trigger it without favourable local conditions. No EPSS score is provided in the input and the CVE is not in CISA KEV, so there is no evidence of active exploitation; the vuln.today decision label is 'this_week', consistent with scheduled remediation rather than act_now/emergency. There is no standalone public exploit in the input, though the Eclipse advisory describes a working regression-test reproducer in the dev branch. Net: a genuine fixable DoS worth patching on a normal priority cycle, materially de-rated from its headline 8.2 by the DoS-only impact and the attacker-uncontrolled trigger conditions.

On a NetX Duo device built with BSD raw-socket and IPv6 support and running an application that sends raw IPv6 packets (IP_RAW_IPV6_HDRINCL) to off-link destinations through a default router that has not been resolved, a remote sender floods the device with ICMPv6 Packet Too Big messages quoting distinct destinations (requires NX_ENABLE_IPV6_PATH_MTU_DISCOVERY) to fill the IPv6 destination table. The next time the application sends a raw IPv6 packet to a new off-link destination, the send path dereferences a NULL destination-table entry and the sending thread crashes (observed as SIGSEGV on the ThreadX Linux port). The Eclipse advisory includes a regression test that reproduces the SIGSEGV 5 of 5 times without the fix; no separate weaponized public exploit is indicated in the input.