Skip to main content

NetX Duo EUVDEUVD-2026-89189

| CVE-2026-102723 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-09-29 eclipse GHSA-h2rg-f2rc-xc9m
Denial Of Service Null Pointer Dereference Eclipse Foundation Netx Duo
6.0
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Adjacent L2 MSRP protocol (AV:A); AC:H because the attacker must exhaust the attribute table rather than send one packet; unauthenticated (PR:N); availability-only crash (A:H).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Sep 29, 2026 - 18:45 vuln.today
CVE Published
Sep 29, 2026 - 17:48 cve.org
MEDIUM 6.0

DescriptionCVE.org

NULL Pointer Dereference on MSRP Attribute Table Exhaustion

AnalysisAI

Attribute table exhaustion in Eclipse ThreadX NetX Duo's MSRP (Multiple Stream Reservation Protocol) handling triggers a NULL pointer dereference that halts the affected device, producing an availability-only denial of service. Only deployments where MSRP/AVB-TSN support is compiled in and actively running are exposed, and the attacker must be on the same Layer-2 bridged segment because MSRP frames are not routed outside the local bridge domain. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the target NetX Duo device to have MSRP (Multiple Stream Reservation Protocol, part of IEEE 802.1 AVB/TSN audio-video bridging) enabled and active - this is a non-default, use-case-specific feature, not part of the base TCP/IP stack. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is an availability-only denial-of-service issue (CWE-476 NULL pointer dereference) in Eclipse ThreadX NetX Duo's MSRP (Multiple Stream Reservation Protocol / IEEE 802.1Qat AVB-TSN) handling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch identified at time of analysis: the only supplied reference is the GitHub security advisory GHSA-jq4g-x753-4cc6 (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-jq4g-x753-4cc6), which should be consulted for the authoritative fix commit or release version before upgrading - do not assume a version number beyond what that advisory states. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Netx Duo

View all
CVE-2026-102761 CRITICAL
9.3 Sep 29

An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACK
CVE-2026-102713 HIGH
8.8 Sep 29

Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an

CVE-2026-102712 HIGH
8.8 Sep 29

Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
CVE-2026-102718 HIGH
8.7 Sep 29

The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated re
CVE-2026-102760 HIGH
8.3 Sep 29

Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device,

CVE-2026-102762 HIGH
8.2 Sep 29

Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
CVE-2026-102717 HIGH
7.5 Sep 30

An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or

CVE-2026-102728 HIGH
7.5 Sep 29

Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through

CVE-2026-102758 HIGH
7.5 Sep 29

NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
CVE-2026-102714 HIGH
7.1 Sep 29

Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
CVE-2026-102722 MEDIUM
6.9 Sep 29

The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, perf
CVE-2026-102721 MEDIUM
6.9 Sep 29

An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server r

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

EUVD-2026-89189 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy