EUVD-2026-105133Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed NetX Secure TLS 1.3 endpoint pre-auth
-
DeliverySend four-byte zero-length Certificate message
-
ExploitLength underflows to 0xFFFFFFFF, bounds check vacuous
-
ExecutionParser reads past session packet buffer
-
ImpactOut-of-bounds read crashes device (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must have NetX Secure negotiating TLS 1.3 and processing Certificate handshake messages (i.e., a reachable TLS 1.3 endpoint, server or client, that enters the certificate-parsing path). No special non-default configuration, authentication, user interaction, or cryptographic validity is required per the description and the AV:N/AC:L/PR:N/UI:N vector - a single malformed four-byte Certificate header triggers it. The practical limiting factors are: the device must expose or initiate TLS 1.3 (deployments restricted to TLS 1.2 or with no network-reachable TLS endpoint are not affected), and the confirmed outcome is a crash/DoS rather than code execution, bounding impact to availability. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, pre-authentication flaw requiring no user interaction and no cryptographic validity - meaning the trigger is trivially achievable against any exposed NetX Secure TLS 1.3 endpoint, which is a strong real-world risk signal. However, the impact is scoped to availability only (VA:H, with VC:N/VI:N), so the vendor assesses this as a denial-of-service (device crash from the out-of-bounds read), NOT remote code execution or data theft. This CONFLICTS with the input Tags, which list 'Information Disclosure': CWE-125 (out-of-bounds read) can leak memory, but the vendor's own vector explicitly rates confidentiality impact as None, suggesting the over-read crashes the stack rather than returning attacker-readable data - treat the 'Information Disclosure' label as unverified. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. Net: a genuine, easy-to-trigger pre-auth DoS worth prioritizing for internet-exposed embedded TLS 1.3 endpoints, but currently a crash/availability issue rather than a confirmed info-leak or RCE, and without exploitation-probability signals to elevate it further. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach a NetX Secure device negotiating TLS 1.3 sends a malformed Certificate handshake message with a zero-length body. The parser decrements the length past zero, wrapping it to 0xFFFFFFFF and defeating the subsequent bounds check, so it reads far beyond the session packet buffer and crashes the device. No public exploit code was identified in the provided data, but the trigger is only a four-byte handshake header requiring no cryptographic validity, making it simple to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
A four-byte malformed TLS 1.3 Certificate handshake header can drive the NetX Secure certificate parser in Eclipse ThreadX NetX Duo past the end of its session packet buffer, crashing the device or stack. The flaw is remotely reachable, unauthenticated, and requires no cryptographic validity or user interaction - the parser decrements the message length to skip a certificate_request_context byte without first confirming a byte exists, so a zero-length message wraps the unsigned length to 0xFFFFFFFF and renders the subsequent bounds check vacuous. Impact is bounded to availability (out-of-bounds read leading to fault/denial of service) per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector, and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical exposure limit is that the target must actually negotiate TLS 1.3 and enter the Certificate-message parsing path.
RemediationAI
Primary remediation is to consume the patched NetX Duo release identified in Eclipse advisory GHSA-893m-9g4r-4992 (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-893m-9g4r-4992); no exact fix version was supplied in the available intelligence, so confirm the fixed tag against that advisory before rebuilding and reflashing firmware, and verify the fix adds an explicit pre-decrement check that the Certificate message body is at least one byte before skipping certificate_request_context. Where firmware cannot be updated promptly, the single most effective compensating control is to disable TLS 1.3 on the NetX Secure instance and constrain the stack to TLS 1.2, which removes the vulnerable Certificate parser path entirely - the trade-off is loss of TLS 1.3 features (0-RTT, simplified cipher suites, improved forward secrecy) and possible interop failures with peers that mandate TLS 1.3. Additionally, block or filter TLS 1.3 handshakes to affected devices at the network perimeter or via an internal TLS-terminating gateway that re-originates a sanitized TLS session, accepting the added latency and the loss of true end-to-end encryption to the device. On platforms with an MPU/MMU, place NetX Secure packet buffers in a guarded or non-executable region so an out-of-bounds read faults predictably rather than silently corrupting adjacent state, and enable a hardware or software watchdog to shorten recovery time from the denial-of-service condition; both measures reduce blast radius but do not eliminate the underlying out-of-bounds read. Monitor the advisory for a CVE-linked fixed release and stage regression testing of TLS 1.3 handshake paths before re-enabling the protocol.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NetX Secure is the TLS/DTLS implementation bundled with Eclipse ThreadX NetX Duo, an embedded TCP/IP stack widely deployed on microcontrollers and RTOS-based IoT devices where memory safety guarantees (MMU/MPU) are often absent. The affected code parses the TLS 1.3 Certificate handshake message, whose body begins with a single-byte certificate_request_context length followed by the certificate_list. To skip that context byte, the parser subtracts one from the remaining message length before validating that any bytes remain; because the length field is an unsigned integer, a Certificate message with a zero-length body underflows to 0xFFFFFFFF in the first decrement. Every subsequent bounds comparison is therefore satisfied trivially, and the parser walks read pointers past the end of the session packet buffer. This is CWE-125 (out-of-bounds read) rooted in a missing pre-decrement length validation - an integer-underflow-into-vacuous-bounds-check pattern. Being pre-authentication and triggered by a four-byte handshake header, the flaw sits in the earliest phase of the TLS 1.3 handshake, before any certificate validation or key exchange, so it is reachable by any host able to open a TLS connection to (or negotiate a client connection from) the affected stack. The corrupted read typically manifests as a memory fault or hard fault reset on bare-metal targets; while the accompanying tags note information disclosure potential, the authoritative assessment bounds confirmed impact to availability. Affected CPE coverage is the wildcard cpe:2.3:a:eclipse_foundation:eclipse_threadx_-_netx_duo:*:*:*:*:*:*:*:*, indicating all released versions are presumed in scope absent a vendor-confirmed fixed release.
Know when Eclipse Threadx Netx Duo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, low-complexity, pre-auth trigger with no interaction gives AV:N/AC:L/PR:N/UI:N; out-of-bounds read reliably crashes the stack (A:H) with no confirmed confidentiality or integrity impact.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
DescriptionCVE.org
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer.
The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.
Technical POC Analysis
Class: CWE-125 (Out-of-bounds Read), with CWE-191 (Integer Underflow / Wraparound) as the enabling defect.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Eclipse ThreadX NetX Duo, the embedded networking and TLS stack inside many connected devices, industrial controllers and IoT products, can be driven to a fault or crash by a four-byte malformed TLS 1.3 Certificate message sent over the network without credentials or user involvement. The exposure is limited to availability: devices that negotiate TLS 1.3 and enter the certificate-parsing path may reboot, hang, or lose service, which for field-deployed equipment can mean disrupted operations, service-level penalties and costly manual recovery. No vendor patch is available yet, so leadership attention should focus on inventorying where NetX Duo is embedded in the product fleet and reducing reachable TLS 1.3 endpoints until a fix ships.
Disable TLS 1.3 on NetX Secure listeners and restrict negotiation to TLS 1.2 where the configuration allows; terminate TLS at an upstream gateway or proxy so embedded devices never parse attacker-supplied TLS 1.3 Certificate messages; segment or firewall device management and service ports to trusted networks only; rate-limit and monitor inbound TLS handshakes for malformed Certificate messages, handshake failures and unexpected device reboots; apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Eclipse Threadx Netx Duo
View allOut-of-bounds write in the TLS 1.3 client of Eclipse ThreadX NetX Duo 6.5.1.202602 allows a malicious or compromised ser
Out-of-bounds write in Eclipse NetX Duo's X.509 certificate-chain verification lets unauthenticated remote attackers cor
Denial of service in the Eclipse ThreadX NetX Duo Web add-on's HTTP server, which mishandles a `Content-Length` underflo
Heap out-of-bounds read in the NetX Secure TLS 1.3 Certificate-message parser of Eclipse ThreadX NetX Duo can be trigger
Denial of service in Eclipse ThreadX NetX Duo HTTP server arises from a flawed remediation of CVE-2025-0728, where the r
HTTP request smuggling in Eclipse ThreadX NetX Duo's optional Web add-on allows unauthenticated remote clients to influe
Exploit-DB