Eclipse NetX Duo EUVD-2026-105140

Exploitation requires the victim device to act as a TLS 1.3 client/peer using NetX Secure and to process a Certificate message from an attacker-controlled or MITM'd TLS 1.3 server; the specific trigger is a malformed Certificate message that causes an unsigned-integer underflow in the Certificate-message parser. It is reachable pre-authentication and before certificate verification completes, so no credentials or prior trust are needed. The principal LIMITING factor is attacker positioning: the attacker must operate or intercept the TLS server the victim connects to - this is not a flaw an attacker can trigger against an unsolicited listening service. Impact per the vendor vector is availability (crash/DoS); confidentiality impact is rated none despite the 'Information Disclosure' tag.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with a base score of 8.7 indicates a network-reachable, low-complexity, pre-authentication flaw, and the impact is scoped purely to availability (VA:H) with no confidentiality or integrity impact (VC:N/VI:N). This is consistent with CWE-125 (out-of-bounds read) manifesting as a crash/denial-of-service rather than data theft. A key nuance the raw score hides: this is a CLIENT-side vulnerability triggered by a MALICIOUS TLS 1.3 SERVER, so real-world exploitation requires the victim peer to initiate (or be redirected into) a handshake with an attacker-controlled endpoint - the 'network/no-privileges/no-UI' metrics are technically accurate but understate the need for attacker positioning. No EPSS score, KEV listing, or POC was provided in the input; therefore exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. Note a signal conflict: the input Tags list 'Information Disclosure' and the description says 'out-of-bounds read,' which could imply memory leakage, yet the authoritative CVSS rates confidentiality at VC:N and availability at VA:H - treat this as an availability/DoS issue unless the vendor advisory confirms readable memory is returned to the attacker. Overall this is a credible, genuinely pre-auth remote DoS against embedded TLS peers, but it is not in the same tier as a wormable RCE and current evidence points to no active exploitation.

A device running Eclipse ThreadX NetX Duo (NetX Secure) acting as a TLS 1.3 client connects to a server the attacker controls or has hijacked via MITM. During the normal handshake, before certificate verification completes, the malicious server returns a crafted Certificate message that triggers an unsigned-integer underflow and a heap out-of-bounds read, crashing or destabilizing the embedded peer. No public exploit code was provided in the input, and low attack complexity (AC:L) with no required privileges or user interaction makes the trigger straightforward once the victim initiates the connection.