NetX Duo EUVD-2026-105153

Requires that the target device run the NetX Duo Web add-on component and expose its HTTP server to the attacker; this optional add-on is not part of the base stack, so devices that do not enable the embedded web server are not exposed. Where the add-on is enabled, the CVSS vector indicates no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L) against reachable instances, so the primary limiting factor is deployment choice (Web add-on present and network-reachable) rather than privilege or configuration hardening. Realistic impact is bounded to request-framing manipulation with low integrity/availability effect (VI:L/VA:L) and no confidentiality impact (VC:N).

This is a genuine but moderate-priority issue, best characterized as HTTP request smuggling (CWE-444) rather than a high-urgency flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated condition, but the impact is deliberately scoped low: VC:N (no confidentiality), VI:L and VA:L (low integrity and low availability), yielding the 6.9 medium base score. The signals are internally consistent on reachability but notably CONFLICT with one of the input Tags: 'Information Disclosure' is listed, yet the authoritative vector sets VC:N, meaning the published metrics do NOT support a confidentiality/disclosure outcome - treat the disclosure framing as unverified and defer to the request-smuggling/framing-manipulation characterization. No EPSS score, KEV listing, SSVC decision, or POC indicator was supplied; the sole reference is an Eclipse GHSA advisory, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: real and remotely triggerable, but the low per-impact metrics and the embedded/optional nature of the affected component keep this below top-tier urgency - patch on a normal cadence, prioritizing devices that actually expose the Web add-on's HTTP server.

An attacker who can reach the HTTP server exposed by the NetX Duo Web add-on sends a crafted request that places a header field name inside the request body; because the server scans the whole packet rather than stopping at the end of the header section, that body content is parsed as a real header and influences request-framing decisions. This enables request-smuggling style manipulation (e.g., desynchronizing how the request is delimited) consistent with the low integrity/availability impact. No public exploit code was identified at time of analysis, and exploitation is remote and unauthenticated per the CVSS vector (PR:N/AC:L).