NetX Duo Web CVE-2026-94018

The device must be running the NetX Duo Web add-on's HTTP server and have it reachable by the attacker; the trigger is a single PUT request whose Content-Length is crafted to cause an underflow, after which an uninitialized pointer is dereferenced and freed. No authentication is required (PR:N) and no user interaction is needed. The principal limiting factor is deployment: only devices that have enabled/compiled in the NetX Duo Web HTTP server component and expose it to the attacker's network are affected - devices using NetX Duo without the Web add-on, or with the HTTP server not network-reachable, are not exposed.

All available CVSS signals point to a genuinely easy-to-reach flaw: the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated trigger needing no user interaction and no special attack requirements, consistent with the description's 'single malformed request.' However, the impact profile tempers the raw 8.8 score: VC:N/VI:L/VA:H means the realistic outcome is denial of service (service/device crash) with limited integrity effect and no confidentiality loss - not remote code execution or data theft. No EPSS probability, no CISA KEV entry, and no POC indicator were provided, so there is no evidence of active or imminent exploitation; the exploitation status is therefore 'no public exploit identified at time of analysis.' A notable conflict exists: the input Tag 'Information Disclosure' contradicts the CVSS confidentiality metric (VC:N) and the CWE-457 (use of uninitialized variable) crash semantics in the description, which read as a memory-safety/DoS issue rather than a disclosure. This should be verified against the Eclipse advisory before treating it as a confidentiality risk. Net: a legitimately high-severity, trivially triggerable DoS in an embedded networking stack, but without exploitation evidence it is a prioritize-for-patching issue rather than a confirmed emergency - with the caveat that embedded/RTOS devices are often hard to patch, which raises operational urgency.

An attacker able to reach a device running the NetX Duo Web add-on HTTP server sends a single crafted PUT request whose Content-Length field is manipulated to cause an underflow. The server mishandles the condition by dereferencing and releasing an uninitialized pointer (CWE-457), crashing the HTTP service or device. No public exploit code has been identified at the time of analysis.