EUVD-2026-89113
GHSA-qfqh-8mhg-fcvw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated peer certificate triggers the read (AV:N/AC:L/PR:N/UI:N); a single discarded one-byte over-read yields at most an unreliable crash, so A:L rather than vendor A:H, with no C/I impact.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
6DescriptionCVE.org
The _nx_secure_x509_asn1_tlv_block_parse() function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake.
The function reads the one-byte ASN.1 tag from the caller's buffer *before* checking that the buffer holds at least one byte. When a caller passes a remaining length of zero, the guard correctly returns NX_SECURE_X509_ASN1_LENGTH_TOO_LONG, but the read has already happened one byte past the end of the buffer.
code:
nx_secure/src/nx_secure_x509_asn1_tlv_block_parse.c
UINT _nx_secure_x509_asn1_tlv_block_parse(const UCHAR *buffer, ULONG *buffer_length, USHORT *tlv_type,
USHORT *tlv_tag_class, ULONG *tlv_length,
const UCHAR **tlv_data, ULONG *header_length)
{
UINT current_index;
USHORT current_tag;
ULONG length;
ULONG length_bytes;
current_index = 0;
current_tag = buffer[current_index]; /* <-- read before the bounds check */
if (*buffer_length < 1)
{
return(NX_SECURE_X509_ASN1_LENGTH_TOO_LONG);
}
The remainder of the function is correctly ordered. The multi-byte length path is guarded by length_bytes > 4 || length_bytes > *buffer_length before its read loop, the decoded value is checked against length > *buffer_length, and the second single-byte length read follows its own *buffer_length < 1 guard. The tag read is the only load placed ahead of its check.
AnalysisAI
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitive that underlies every X.509 certificate operation, so a remote, unauthenticated peer can trigger it by supplying a crafted DER certificate during the TLS handshake - either against a TLS client validating a server certificate or a TLS server configured for client-certificate (mTLS) authentication. Per the independent assessment the realistic impact is limited to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), because the over-read byte is discarded and a crash requires that byte to land in unmapped or guarded memory, which is layout- and platform-dependent and frequently harmless on MMU-less embedded targets; NVD's 7.5/H score reflects the worst-case interpretation of the same vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to run NetX Secure and parse an X.509 certificate supplied by a remote peer during a TLS handshake - i.e., any TLS client validating a server certificate, or any TLS server configured for client-certificate (mutual TLS) authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a one-byte out-of-bounds read (CWE-126) in `_nx_secure_x509_asn1_tlv_block_parse()`, the ASN.1 primitive underlying all X.509 parsing in NetX Secure, reachable remotely during the TLS handshake. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix referenced by the GitHub Security Advisory GHSA-f95g-xc4w-mrcr for eclipse-threadx/netxduo and upgrade NetX Duo to the patched release it identifies; an exact fixed version number is not stated in the provided data, so confirm the correct release line against that advisory rather than assuming 6.5.1.202602 or later is safe. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all products and deployments that include NetX Duo (NetX Secure) through 6.5.1.202602 and identify which assets act as TLS clients validating remote server certificates or as TLS servers configured for client-certificate (mTLS) authentication; restrict network access to those TLS endpoints to trusted peers or management networks and enable crash/reboot monitoring. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
MajorDoMo home automation platform is vulnerable to unauthenticated remote code execution through supply chain compromis
Unauthenticated backup download and RCE in Nginx UI before 2.3.3. EPSS 1.0%. PoC available.
FastCGI path splitting vulnerability in Caddy before 2.11.1 allows request smuggling or path confusion when proxying to
TLS error swallowing in Caddy web server before 2.11.1 allows bypassing client certificate authentication. Errors in Cli
Host header case sensitivity bypass in Caddy before 2.11.1. Virtual host routing can be bypassed by using alternate casi
Case sensitivity bypass in Caddy web server path matching before 2.11.1. HTTP path matchers can be bypassed using altern
Alist file manager has an improper certificate validation vulnerability allowing MITM attacks that could compromise file
Caddy versions 2.10.0 through 2.11.1 fail to strip client-supplied headers in the forward_auth copy_headers directive, e
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS ce
Caddy versions 2.7.5 through 2.11.1 contain a template injection vulnerability in the vars_regexp matcher that allows re
SumatraPDF versions 3.5.0 through 3.5.2 fail to validate TLS certificates during software updates and execute installers
EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today