NetX Duo EUVD-2026-94228

Exploitation requires that the affected device run the NetX Duo TLS 1.3 CLIENT and be induced to initiate a TLS 1.3 handshake to an attacker-controlled or compromised server; the oversized handshake message is delivered during that handshake and the out-of-bounds write is reached BEFORE server certificate authentication, so a valid server certificate is NOT required and certificate pinning/validation does not block it. Limiting factors that reduce real-world exposure: the flaw is client-side (the victim, not the attacker, initiates the connection), it is specific to the TLS 1.3 handshake path in NetX Duo version 6.5.1.202602, and it does not apply to deployments that do not use the NetX Duo TLS client or TLS 1.3. There is no unauthenticated remote server-side listener attack here - the attacker must control the server endpoint the client reaches.

This is a genuine high-priority vulnerability, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.3) indicates a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact - consistent with the description of an out-of-bounds write (CWE-787) that corrupts pointer-bearing fields of the TLS session control block, a classic path to memory corruption and likely remote code execution on the embedded client. The most important signal is that the write is reachable BEFORE certificate authentication completes, so the normal trust anchor (server certificate validation) does not mitigate it; any malicious or compromised server a client is induced to connect to can trigger it. Signals that TEMPER urgency: EPSS is not provided in the input, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. One nuance to verify: this is a CLIENT-side vulnerability requiring the victim to initiate a TLS 1.3 connection to an attacker-controlled or compromised server, which is a meaningful real-world precondition even though CVSS encodes it as AV:N/UI:N. Net: treat as a serious patch-soon issue for any deployment running the NetX Duo TLS 1.3 client, while recognizing exploitation is currently theoretical pending a POC.

An attacker stands up (or compromises) a TLS server and lures or redirects a NetX Duo TLS 1.3 client - e.g. an IoT/embedded device performing an outbound TLS connection - to connect to it. During the handshake, before any certificate is validated, the server sends a handshake message larger than the client's handshake message cache, causing an out-of-bounds write that overruns the cache into adjacent pointer fields of the session control block, enabling memory corruption and potential remote code execution on the device. No public exploit identified at time of analysis, so this is currently a theoretical chain.