Netx Duo (Eclipse Foundation) - vulnerabilities (CVEs)

32 CVEs, 21 in the last 30 days, 1 known versions, newest CVE from 2026-10-14. Vendor: Eclipse Foundation.

CVEs of Netx Duo

• CVE-2026-106465 - CVSS 8.7 (high), 2026-10-14: The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello…
• CVE-2026-106464 - CVSS 8.7 (high), 2026-10-14: `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A…
• CVE-2026-103415 - CVSS 9.3 (critical), 2026-10-14: When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the…
• CVE-2026-102717 - CVSS 7.5 (high), 2026-09-30: MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
• CVE-2026-102727 - CVSS 6 (medium), 2026-09-29: FTP Passive Data Connection Not Bound to the Authenticated Control Peer
• CVE-2026-102728 - CVSS 7.5 (high), 2026-09-29: Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to…
• CVE-2026-102726 - CVSS 6 (medium), 2026-09-29: Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
• CVE-2026-102725 - CVSS 6 (medium), 2026-09-29: Out-of-bounds Read from Unvalidated MSRP Attribute List Length
• CVE-2026-102724 - CVSS 6 (medium), 2026-09-29: NULL Pointer Dereference When Evicting the Sole MSRP Attribute
• CVE-2026-102723 - CVSS 6 (medium), 2026-09-29: NULL Pointer Dereference on MSRP Attribute Table Exhaustion
• CVE-2026-102722 - CVSS 6.9 (medium), 2026-09-29: In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values,…
• CVE-2026-102721 - CVSS 6.9 (medium), 2026-09-29: A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the…
• CVE-2026-102718 - CVSS 8.7 (high), 2026-09-29: hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID…
• CVE-2026-102714 - CVSS 7.1 (high), 2026-09-29: `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a…
• CVE-2026-102713 - CVSS 8.8 (high), 2026-09-29: The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere…
• CVE-2026-102712 - CVSS 8.8 (high), 2026-09-29: On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length…
• CVE-2026-102762 - CVSS 8.2 (high), 2026-09-29: The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the…
• CVE-2026-102761 - CVSS 9.3 (critical), 2026-09-29: NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound…
• CVE-2026-102760 - CVSS 8.3 (high), 2026-09-29: When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP…
• CVE-2026-102759 - CVSS 6.3 (medium), 2026-09-29: NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted…
• CVE-2026-102758 - CVSS 7.5 (high), 2026-09-29: The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all…
• CVE-2025-55085 - CVSS 8.8 (high), 2025-10-17: In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing…
• CVE-2025-55094 - CVSS 7.5 (high), 2025-10-17: In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in…
• CVE-2025-55096 - CVSS 6.1 (medium), 2025-10-17: In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in…
• CVE-2025-55093 - CVSS 6.9 (medium), 2025-10-17: In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in…
• CVE-2025-55092 - CVSS 6.9 (medium), 2025-10-17: In Eclipse Foundation NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in…
• CVE-2025-55091 - CVSS 6.9 (medium), 2025-10-16: In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in…
• CVE-2025-55090 - CVSS 6.9 (medium), 2025-10-16: In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in…
• CVE-2025-55084 - CVSS 6.9 (medium), 2025-10-16: In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check…
• CVE-2025-55083 - CVSS 6.9 (medium), 2025-10-15: In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check resulting it out by two out of bound read.
• CVE-2025-55082 - CVSS 6.9 (medium), 2025-10-15: In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was a potential out of bound read in _nx_secure_tls_process_clienthello()…
• CVE-2025-55081 - CVSS 9.1 (critical), 2025-10-15: In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of…