Eclipse NetX Duo CVE-2026-93475

Exploitation requires that the target use NetX Secure's X.509 certificate-chain verification over TLS or DTLS and that the attacker-supplied intermediate carry an RSA modulus larger than NX_CRYPTO_MAX_RSA_MODULUS_SIZE (default 4096 bits). Two concrete trigger paths exist: a TLS/DTLS CLIENT verifying a malicious server's chain (no special configuration - ordinary server-certificate validation), and a SERVER that has client-certificate authentication (mutual TLS) enabled, which is the limiting factor for the server-side path since mutual TLS is not a default in most deployments. No authentication is needed because the malicious issuer is resolved from the remote peer-supplied store before the trusted store, so the attacker's oversized key is used in the crypto operation without chaining to a trusted root. The main limiting factor is simply that the target must initiate or accept certificate verification against the attacker - trivially satisfied for the client path, configuration-gated for the server path.

All available signals point to a genuine high-priority issue rather than a CVSS-inflated low-risk one. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) is internally consistent with the description: an out-of-bounds write (CWE-787) reachable pre-authentication over the network with low complexity and no user interaction, because the attacker simply presents an oversized RSA modulus as an intermediate in a certificate chain the target verifies. The description's claim that the malicious issuer is resolved from the peer-supplied store BEFORE the trusted store is the key enabler - it removes any need for the attacker's cert to actually chain to a trusted root, so PR:N is credible rather than optimistic. Signals are NOT fully corroborated across sources: there is no EPSS score, no CISA KEV listing, and no indication of public exploit code in the provided intelligence, so this is 'no public exploit identified at time of analysis' and must not be described as actively exploited. The combination of pre-auth network reach, a memory-corruption primitive in a TLS/DTLS stack, and both client-side and server-side (mutual-TLS) trigger paths makes this a strong patch priority despite the absence of exploitation telemetry; the missing EPSS/KEV data reflects the vulnerability's recency, not low severity.

An attacker stands up a malicious TLS/DTLS server (or connects as a malicious client to a mutual-TLS server) and presents a certificate chain containing an intermediate whose RSA public key modulus exceeds 4096 bits. When the NetX Secure X.509 verifier performs ordinary chain verification, the oversized key is decrypted into a fixed-size buffer, causing an out-of-bounds write past a file-scope static before any authentication completes. No public exploit code is identified in the available data, but the low attack complexity and lack of required privileges or user interaction make reliable triggering straightforward.