Netx Duo
Monthly
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or compromised broker - or a man-in-the-middle on the WebSocket connection - crash the embedded network stack and potentially disclose a limited amount of adjacent memory. Affected builds are NetX Duo 6.4.4 through 6.5.1.202602, and only firmware that actually compiles in and uses the MQTT client over WebSocket is exposed; devices running plain MQTT/TCP or no MQTT are unaffected. Exploitation is not confirmed as active (not in CISA KEV) and no public exploit code has been identified at time of analysis, but CISA SSVC rates the issue Automatable with partial technical impact, so the practical risk is a conditional availability problem rather than an emergency, with a confidentiality impact the vendor's original CVSS score omits but which the independent assessment reflects as C:L/A:H.
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through 6.5.1.202602 allow an attacker who controls or impersonates the TLS/DTLS server to make the client parse a truncated handshake message and read a few bytes past the end of the buffer. The flaw is reachable over the network with no authentication or user interaction in the CVSS vector (AV:N/AC:L/PR:N/UI:N), but it is only triggerable when a NetX Secure client initiates a handshake toward attacker-steered server infrastructure; devices that only connect to trusted or pinned servers are substantially less exposed. No public exploit code and no CISA KEV activity were identified at time of analysis, and the impact is bounded: the independent assessment rates it confidentiality-low/availability-low (CVSS 3.1 base 6.x-equivalent) rather than the vendor's confidentiality-high score, since the over-read leaks a small amount of adjacent memory rather than yielding arbitrary disclosure or code execution.
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated remote SNMP packet whose object identifier uses BER multibyte length encoding to claim a length larger than the receive buffer, causing `_nx_snmp_utility_object_id_get` to decode adjacent heap bytes as OID components. On memory-protected (MMU/MPU) builds this faults into a crash of the SNMP agent thread, producing denial of service, while on bare-metal no-MMU targets the out-of-bounds read succeeds silently and instead corrupts the agent's internal OID state with neighboring heap data. Exposure is conditional: the NetX Duo SNMP addon must be compiled into the firmware and actively listening (typically UDP/161), so builds without an SNMP-enabled agent are unaffected; no public exploit code has been identified at time of analysis (no CISA KEV listing).
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffers, causing denial of service on devices reachable from the same local link. The affected product is NetX Duo with IPv6/ICMPv6 ND enabled; an adjacent-network attacker with no authentication or user interaction can send crafted Router Advertisement, Router/Neighbor Solicitation, Neighbor Advertisement, or Redirect messages so that a one- or two-byte residue bypasses option validation and later processing loops indefinitely or underflows its counters. The vendor's CVSS 4.0 score is 7.1 (availability-only), the referenced advisory is GHSA-39p4-p83c-58hr, no public exploit identified at time of analysis, and no CISA KEV confirmation is provided.
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an unauthenticated remote attacker sending a single oversized DATA datagram over the network, because the DATA branch enforces only a four-byte minimum (nxd_tftp_server.c:1037) and never validates an upper bound against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. The oversized length is passed as nx_packet_length - 4 into FileX via fx_file_write, and since nx_packet_length measures the whole packet chain rather than the first contiguous buffer, FileX reads past the end of that buffer and the leaked heap contents are written into the file the attacker is uploading, which a subsequent TFTP read request returns to the attacker; the same datagram also wedges the server permanently because nx_packet_copy with NX_WAIT_FOREVER suspends the server thread once the request exceeds the packet pool capacity. Rated CVSS 4.0 base 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H), consistent with an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H, and no public exploit code was identified at time of analysis, though the attack path is trivially scriptable and requires only that the optional TFTP addon be compiled in and reachable.
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disclose up to 255 bytes of adjacent process memory over the network, or to crash the device. The flaw triggers on the very first ClientHello and requires no prior session, credentials, or user interaction, affecting default DTLS-enabled deployments with a reachable DTLS/UDP listener. No public exploit code has been identified at time of analysis, but the issue is rated CVSS 8.8 and is considered a high-priority risk among the NetX Secure DTLS/TLS advisory cluster.
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can deliver a few dozen such messages exhaust the network driver's receive pool and halt all inbound traffic on the device until it is rebooted. Only builds including the NetX Duo MQTT client are exposed, and delivery requires broker control, a man-in-the-middle position on the MQTT session, or publish rights on a topic the client subscribes to, which is why the impact is availability-only (CVSS 4.0 base 8.2; assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) despite a network attack vector. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACKET control block structures via a maliciously crafted masked WebSocket frame, potentially leading to code execution or denial of service. The vulnerability, tracked as CVE-2026-102761 with a CVSS 4.0 score of 9.3, affects all versions of NetX Duo per the CPE. No public exploit code has been identified at time of analysis, and no KEV status is reported.
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device, because each outbound TLS record is zeroed after the TCP layer has already taken ownership of - and may have freed and recycled - the underlying packet chain. The defect is a CWE-416 use-after-free write with a length underflow on reused packets, reachable from the network without authentication (CVSSv3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, with the published CVSS 4.0 score of 8.3 reflecting the availability impact). It is not present in default builds: exploitation requires the non-default NX_SECURE_KEY_CLEAR compile-time option plus packet-pool free/reuse timing an attacker cannot deterministically force, so practical risk is lower than the headline score; no public exploit identified at time of analysis and no confirmed active exploitation.
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitive that underlies every X.509 certificate operation, so a remote, unauthenticated peer can trigger it by supplying a crafted DER certificate during the TLS handshake - either against a TLS client validating a server certificate or a TLS server configured for client-certificate (mTLS) authentication. Per the independent assessment the realistic impact is limited to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), because the over-read byte is discarded and a crash requires that byte to land in unmapped or guarded memory, which is layout- and platform-dependent and frequently harmless on MMU-less embedded targets; NVD's 7.5/H score reflects the worst-case interpretation of the same vector. There is no confirmed active exploitation (CISA SSVC: Exploitation = none) and no public exploit code identified at time of analysis, though CISA rates the issue Automatable = yes and Technical Impact = partial.
Information disclosure in the Eclipse ThreadX NetX Duo embedded TCP/IP stack's FTP server addon lets a network attacker consume data belonging to an authenticated FTP session, because the server never ties the passive-mode data connection back to the peer on the control channel. Exploiting this requires the target to be running the NetX Duo FTP server and a client to be performing or negotiating a passive-mode transfer at the moment of attack, and the attacker must reach the announced passive port and win a connection race against the legitimate client before it connects; no authentication is required (PR:N), but the timing dependency makes complexity high (AC:H, UI:P) and the impact is limited to confidentiality (C:H/I:N/A:N, CVSS 4.0 base 6.0). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw should be treated as a genuine but moderate-priority confidentiality issue rather than a high-severity one.
Crafted IPCP configuration options sent by a PPP peer can stall a NetX Duo worker thread and drive an out-of-bounds read in Eclipse ThreadX NetX Duo builds that enable the PPP/IPCP add-on. Only devices that terminate PPP links (serial, cellular modem, PPPoE, or L2TP) and accept negotiation traffic from an attacker-controlled or untrusted peer are exposed, and the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) reflects adjacency rather than remote reachability. Exploitation is unauthenticated and needs a specifically crafted IPCP option with an oversized declared length, but no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Out-of-bounds reads in Eclipse NetX Duo's MSRP (Multiple Stream Reservation Protocol) attribute-list parser allow an attacker positioned on the same layer-2 network segment to crash a device by supplying a malformed attribute list whose length field is never validated. The flaw affects NetX Duo builds that have the MSRP / TSN-AVB stream-reservation feature compiled in and actively processing MSRP traffic; because exploitation requires adjacent-network access and yields only a denial of service - no confidentiality or integrity impact, and no code execution is claimed - this is a bounded availability issue rather than a remotely exploitable high-severity defect. There is no CISA KEV listing and no public exploit code identified at time of analysis, so exploitation is assessed as unconfirmed.
Eclipse NetX Duo can be crashed (high availability impact) by an unauthenticated attacker on the same Layer-2 network segment who manipulates MSRP attribute state so that the sole remaining MSRP attribute is evicted, triggering a NULL pointer dereference. This is a genuine but bounded availability-only risk: MSRP (IEEE 802.1 AVB/TSN) must be enabled, and the attacker must achieve a precise attribute-table condition (AT:P), so it is not a stateless single-packet trigger. No public exploit code has been identified at time of analysis; the vendor-assigned CVSS 4.0 base score is 6.0, and our independent CVSS 3.1 assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms adjacent-only, state-dependent denial of service.
Attribute table exhaustion in Eclipse ThreadX NetX Duo's MSRP (Multiple Stream Reservation Protocol) handling triggers a NULL pointer dereference that halts the affected device, producing an availability-only denial of service. Only deployments where MSRP/AVB-TSN support is compiled in and actively running are exposed, and the attacker must be on the same Layer-2 bridged segment because MSRP frames are not routed outside the local bridge domain. No public exploit code has been identified at time of analysis, and success requires sustained flooding of attribute registration frames rather than a single packet, giving this an assessed severity in the moderate range despite the total loss of availability on a targeted device.
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, performing only parse and non-zero checks before opening a data connection to that address, which lets a malicious or man-in-the-middle FTP server redirect the client's data transfer to any host it names (CWE-918 server-side request forgery class). Only the IPv4 passive-mode path is affected; the client must itself initiate an FTP control session to a hostile or intercepted endpoint and then request a passive transfer. No authentication or user interaction beyond starting the session is required (CVSS:4.0 base 6.9; independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), and no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server return a short ERROR packet that causes the client to read up to 64 bytes past the received datagram. The vulnerable receive paths are in the TFTP client add-on and an unauthenticated remote attacker can trigger the condition when a device initiates a TFTP read or open against the attacker's server, potentially disclosing adjacent packet-pool memory if the application logs or displays nx_tftp_client_error_string, and potentially causing a crash. No public exploit identified at time of analysis, and the provided advisory points to a code-level bounds-check fix; risk is moderate rather than critical because exploitation requires the client-initiated, attacker-as-server model and yields no write primitive.
Eclipse NetX Duo's NetX Secure TLS stack accepts empty application-data records without ever generating or comparing their message authentication code, so the receive sequence number advances on records that were never integrity-checked. An unauthenticated remote attacker who holds a man-in-the-middle position on an already-established TLS connection can inject such records into the stream, yielding a bounded loss of integrity and availability (no confidentiality impact). Exploitation is constrained by high attack complexity, no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing).
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or compromised broker - or a man-in-the-middle on the WebSocket connection - crash the embedded network stack and potentially disclose a limited amount of adjacent memory. Affected builds are NetX Duo 6.4.4 through 6.5.1.202602, and only firmware that actually compiles in and uses the MQTT client over WebSocket is exposed; devices running plain MQTT/TCP or no MQTT are unaffected. Exploitation is not confirmed as active (not in CISA KEV) and no public exploit code has been identified at time of analysis, but CISA SSVC rates the issue Automatable with partial technical impact, so the practical risk is a conditional availability problem rather than an emergency, with a confidentiality impact the vendor's original CVSS score omits but which the independent assessment reflects as C:L/A:H.
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through 6.5.1.202602 allow an attacker who controls or impersonates the TLS/DTLS server to make the client parse a truncated handshake message and read a few bytes past the end of the buffer. The flaw is reachable over the network with no authentication or user interaction in the CVSS vector (AV:N/AC:L/PR:N/UI:N), but it is only triggerable when a NetX Secure client initiates a handshake toward attacker-steered server infrastructure; devices that only connect to trusted or pinned servers are substantially less exposed. No public exploit code and no CISA KEV activity were identified at time of analysis, and the impact is bounded: the independent assessment rates it confidentiality-low/availability-low (CVSS 3.1 base 6.x-equivalent) rather than the vendor's confidentiality-high score, since the over-read leaks a small amount of adjacent memory rather than yielding arbitrary disclosure or code execution.
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated remote SNMP packet whose object identifier uses BER multibyte length encoding to claim a length larger than the receive buffer, causing `_nx_snmp_utility_object_id_get` to decode adjacent heap bytes as OID components. On memory-protected (MMU/MPU) builds this faults into a crash of the SNMP agent thread, producing denial of service, while on bare-metal no-MMU targets the out-of-bounds read succeeds silently and instead corrupts the agent's internal OID state with neighboring heap data. Exposure is conditional: the NetX Duo SNMP addon must be compiled into the firmware and actively listening (typically UDP/161), so builds without an SNMP-enabled agent are unaffected; no public exploit code has been identified at time of analysis (no CISA KEV listing).
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffers, causing denial of service on devices reachable from the same local link. The affected product is NetX Duo with IPv6/ICMPv6 ND enabled; an adjacent-network attacker with no authentication or user interaction can send crafted Router Advertisement, Router/Neighbor Solicitation, Neighbor Advertisement, or Redirect messages so that a one- or two-byte residue bypasses option validation and later processing loops indefinitely or underflows its counters. The vendor's CVSS 4.0 score is 7.1 (availability-only), the referenced advisory is GHSA-39p4-p83c-58hr, no public exploit identified at time of analysis, and no CISA KEV confirmation is provided.
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an unauthenticated remote attacker sending a single oversized DATA datagram over the network, because the DATA branch enforces only a four-byte minimum (nxd_tftp_server.c:1037) and never validates an upper bound against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. The oversized length is passed as nx_packet_length - 4 into FileX via fx_file_write, and since nx_packet_length measures the whole packet chain rather than the first contiguous buffer, FileX reads past the end of that buffer and the leaked heap contents are written into the file the attacker is uploading, which a subsequent TFTP read request returns to the attacker; the same datagram also wedges the server permanently because nx_packet_copy with NX_WAIT_FOREVER suspends the server thread once the request exceeds the packet pool capacity. Rated CVSS 4.0 base 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H), consistent with an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H, and no public exploit code was identified at time of analysis, though the attack path is trivially scriptable and requires only that the optional TFTP addon be compiled in and reachable.
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disclose up to 255 bytes of adjacent process memory over the network, or to crash the device. The flaw triggers on the very first ClientHello and requires no prior session, credentials, or user interaction, affecting default DTLS-enabled deployments with a reachable DTLS/UDP listener. No public exploit code has been identified at time of analysis, but the issue is rated CVSS 8.8 and is considered a high-priority risk among the NetX Secure DTLS/TLS advisory cluster.
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can deliver a few dozen such messages exhaust the network driver's receive pool and halt all inbound traffic on the device until it is rebooted. Only builds including the NetX Duo MQTT client are exposed, and delivery requires broker control, a man-in-the-middle position on the MQTT session, or publish rights on a topic the client subscribes to, which is why the impact is availability-only (CVSS 4.0 base 8.2; assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) despite a network attack vector. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACKET control block structures via a maliciously crafted masked WebSocket frame, potentially leading to code execution or denial of service. The vulnerability, tracked as CVE-2026-102761 with a CVSS 4.0 score of 9.3, affects all versions of NetX Duo per the CPE. No public exploit code has been identified at time of analysis, and no KEV status is reported.
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device, because each outbound TLS record is zeroed after the TCP layer has already taken ownership of - and may have freed and recycled - the underlying packet chain. The defect is a CWE-416 use-after-free write with a length underflow on reused packets, reachable from the network without authentication (CVSSv3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, with the published CVSS 4.0 score of 8.3 reflecting the availability impact). It is not present in default builds: exploitation requires the non-default NX_SECURE_KEY_CLEAR compile-time option plus packet-pool free/reuse timing an attacker cannot deterministically force, so practical risk is lower than the headline score; no public exploit identified at time of analysis and no confirmed active exploitation.
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitive that underlies every X.509 certificate operation, so a remote, unauthenticated peer can trigger it by supplying a crafted DER certificate during the TLS handshake - either against a TLS client validating a server certificate or a TLS server configured for client-certificate (mTLS) authentication. Per the independent assessment the realistic impact is limited to availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), because the over-read byte is discarded and a crash requires that byte to land in unmapped or guarded memory, which is layout- and platform-dependent and frequently harmless on MMU-less embedded targets; NVD's 7.5/H score reflects the worst-case interpretation of the same vector. There is no confirmed active exploitation (CISA SSVC: Exploitation = none) and no public exploit code identified at time of analysis, though CISA rates the issue Automatable = yes and Technical Impact = partial.
Information disclosure in the Eclipse ThreadX NetX Duo embedded TCP/IP stack's FTP server addon lets a network attacker consume data belonging to an authenticated FTP session, because the server never ties the passive-mode data connection back to the peer on the control channel. Exploiting this requires the target to be running the NetX Duo FTP server and a client to be performing or negotiating a passive-mode transfer at the moment of attack, and the attacker must reach the announced passive port and win a connection race against the legitimate client before it connects; no authentication is required (PR:N), but the timing dependency makes complexity high (AC:H, UI:P) and the impact is limited to confidentiality (C:H/I:N/A:N, CVSS 4.0 base 6.0). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw should be treated as a genuine but moderate-priority confidentiality issue rather than a high-severity one.
Crafted IPCP configuration options sent by a PPP peer can stall a NetX Duo worker thread and drive an out-of-bounds read in Eclipse ThreadX NetX Duo builds that enable the PPP/IPCP add-on. Only devices that terminate PPP links (serial, cellular modem, PPPoE, or L2TP) and accept negotiation traffic from an attacker-controlled or untrusted peer are exposed, and the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) reflects adjacency rather than remote reachability. Exploitation is unauthenticated and needs a specifically crafted IPCP option with an oversized declared length, but no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Out-of-bounds reads in Eclipse NetX Duo's MSRP (Multiple Stream Reservation Protocol) attribute-list parser allow an attacker positioned on the same layer-2 network segment to crash a device by supplying a malformed attribute list whose length field is never validated. The flaw affects NetX Duo builds that have the MSRP / TSN-AVB stream-reservation feature compiled in and actively processing MSRP traffic; because exploitation requires adjacent-network access and yields only a denial of service - no confidentiality or integrity impact, and no code execution is claimed - this is a bounded availability issue rather than a remotely exploitable high-severity defect. There is no CISA KEV listing and no public exploit code identified at time of analysis, so exploitation is assessed as unconfirmed.
Eclipse NetX Duo can be crashed (high availability impact) by an unauthenticated attacker on the same Layer-2 network segment who manipulates MSRP attribute state so that the sole remaining MSRP attribute is evicted, triggering a NULL pointer dereference. This is a genuine but bounded availability-only risk: MSRP (IEEE 802.1 AVB/TSN) must be enabled, and the attacker must achieve a precise attribute-table condition (AT:P), so it is not a stateless single-packet trigger. No public exploit code has been identified at time of analysis; the vendor-assigned CVSS 4.0 base score is 6.0, and our independent CVSS 3.1 assessment (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms adjacent-only, state-dependent denial of service.
Attribute table exhaustion in Eclipse ThreadX NetX Duo's MSRP (Multiple Stream Reservation Protocol) handling triggers a NULL pointer dereference that halts the affected device, producing an availability-only denial of service. Only deployments where MSRP/AVB-TSN support is compiled in and actively running are exposed, and the attacker must be on the same Layer-2 bridged segment because MSRP frames are not routed outside the local bridge domain. No public exploit code has been identified at time of analysis, and success requires sustained flooding of attribute registration frames rather than a single packet, giving this an assessed severity in the moderate range despite the total loss of availability on a targeted device.
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, performing only parse and non-zero checks before opening a data connection to that address, which lets a malicious or man-in-the-middle FTP server redirect the client's data transfer to any host it names (CWE-918 server-side request forgery class). Only the IPv4 passive-mode path is affected; the client must itself initiate an FTP control session to a hostile or intercepted endpoint and then request a passive transfer. No authentication or user interaction beyond starting the session is required (CVSS:4.0 base 6.9; independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), and no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server return a short ERROR packet that causes the client to read up to 64 bytes past the received datagram. The vulnerable receive paths are in the TFTP client add-on and an unauthenticated remote attacker can trigger the condition when a device initiates a TFTP read or open against the attacker's server, potentially disclosing adjacent packet-pool memory if the application logs or displays nx_tftp_client_error_string, and potentially causing a crash. No public exploit identified at time of analysis, and the provided advisory points to a code-level bounds-check fix; risk is moderate rather than critical because exploitation requires the client-initiated, attacker-as-server model and yields no write primitive.
Eclipse NetX Duo's NetX Secure TLS stack accepts empty application-data records without ever generating or comparing their message authentication code, so the receive sequence number advances on records that were never integrity-checked. An unauthenticated remote attacker who holds a man-in-the-middle position on an already-established TLS connection can inject such records into the stream, yielding a bounded loss of integrity and availability (no confidentiality impact). Exploitation is constrained by high attack complexity, no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing).