Skip to main content

NetX Duo EUVDEUVD-2026-89193

| CVE-2026-102726 MEDIUM
Out-of-bounds Read (CWE-125)
2026-09-29 eclipse GHSA-5fjx-5wfx-f7jp
Buffer Overflow Information Disclosure Eclipse Foundation Netx Duo
6.0
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.1 HIGH

PPP point-to-point delivery is adjacent (AV:A), no auth or interaction (PR:N/UI:N); OOB read gives minor leak (C:L) while thread stall drives availability (A:H); no integrity impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Sep 29, 2026 - 18:47 vuln.today
CVE Published
Sep 29, 2026 - 17:51 cve.org
MEDIUM 6.0

DescriptionCVE.org

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read

AnalysisAI

Crafted IPCP configuration options sent by a PPP peer can stall a NetX Duo worker thread and drive an out-of-bounds read in Eclipse ThreadX NetX Duo builds that enable the PPP/IPCP add-on. Only devices that terminate PPP links (serial, cellular modem, PPPoE, or L2TP) and accept negotiation traffic from an attacker-controlled or untrusted peer are exposed, and the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) reflects adjacency rather than remote reachability. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the NetX Duo PPP/IPCP addon to be compiled in and active, and the attacker must occupy the PPP peer position on a point-to-point link (serial, cellular modem, PPPoE/L2TP) so a malformed IPCP configuration packet can be delivered during link negotiation - hence AV:A (adjacent), not remote. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but bounded-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor remediation is documented in the Eclipse ThreadX NetX Duo security advisory GHSA-2wwp-ffgp-6ggj (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-2wwp-ffgp-6ggj); because no exact fix version is confirmed in the available data, treat it as patch availability per vendor advisory and confirm the corrected release for your branch before rollout, then rebuild and reflash affected firmware. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Netx Duo

View all
CVE-2026-102761 CRITICAL
9.3 Sep 29

An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACK
CVE-2026-102713 HIGH
8.8 Sep 29

Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an

CVE-2026-102712 HIGH
8.8 Sep 29

Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
CVE-2026-102718 HIGH
8.7 Sep 29

The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated re
CVE-2026-102760 HIGH
8.3 Sep 29

Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device,

CVE-2026-102762 HIGH
8.2 Sep 29

Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
CVE-2026-102717 HIGH
7.5 Sep 30

An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or

CVE-2026-102728 HIGH
7.5 Sep 29

Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through

CVE-2026-102758 HIGH
7.5 Sep 29

NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
CVE-2026-102714 HIGH
7.1 Sep 29

Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
CVE-2026-102722 MEDIUM
6.9 Sep 29

The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, perf
CVE-2026-102721 MEDIUM
6.9 Sep 29

An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server r

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

EUVD-2026-89193 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy