Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 462

Export CSV
CVE-2026-106465

Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, and treats any non-empty cookie as verified. A remote attacker can make the server send its full handshake flight, several kilobytes, to a forged source address, using it to reflect amplified traffic at a third party.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-106464

Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102718

Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the request without checking it against the bytes present, and reads past the end of the packet buffer. A remote, unauthenticated attacker can send a crafted SNMP request that makes the agent read adjacent memory into its OID state, faulting the agent on targets with memory protection.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102716

A malformed Session header permanently orphans one packet-pool block per RTSP request

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session header and never releases the response packet it allocated. An unauthenticated client can drain the server's packet pool with a few dozen requests, stopping the RTSP server and, where the pool is shared, the rest of the network stack until the device restarts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx Netx Duo
CVE-2026-102714

ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area that ends in a one- or two-byte residue, and the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect handlers then walk it without length checks. A host on the local link can send one such message to make the IP thread read past the packet or loop forever, and can place off-packet memory in the neighbor cache.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102713

Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the received packet into the file and read it back by downloading the file, and the same datagram can suspend the server thread permanently.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102712

Out-of-bounds read in the NetX Secure DTLS ClientHello parser

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with DTLS server support, the NetX Secure DTLS server's ClientHello parser reads the session ID, cookie and ciphersuite list without bounding them by the bytes remaining in the message. An unauthenticated peer can send a ClientHello declaring fields longer than the message and make the server read past it; nothing read is sent back to the peer, and the read can fault the server only on targets that trap the address beyond the buffer.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102728

Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS client's HelloVerifyRequest parser read fields before checking that the message is long enough to contain them. A malicious server or an on-path attacker can make the client read up to three bytes past a handshake message, which can fault the client on targets with memory protection.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102727

FTP Passive Data Connection Not Bound to the Authenticated Control Peer

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without checking that it comes from the client that requested passive mode. An unauthenticated network attacker who connects to the predictable port first receives the file an authenticated user downloads, or supplies the content of the file the user uploads.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102726

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure-Nak without validating each option's length. A malicious PPP peer can stall the PPP thread indefinitely with a zero-length option, taking the link down, and can read back up to four bytes of packet-buffer memory per exchange with a short address option.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102725

Out-of-bounds Read from Unvalidated MSRP Attribute List Length

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list length from the received frame without comparing it with the packet length. An unauthenticated station on the same Layer 2 segment can send a short MSRP frame declaring a long list and make the MRP worker read far past the received packet, faulting it on targets with memory protection.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102724

NULL pointer dereference when evicting the last MSRP attribute in a participant's list

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring one MSRP attribute and withdrawing it, and ordinary withdrawals by legitimate stations reach the same path.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102723

NULL Pointer Dereference on MSRP Attribute Table Exhaustion

In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through the null pointer returned by its allocator when the ten-entry attribute table is full. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring enough new attributes, and Talker Failed declarations hold table entries that are never released.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102719

NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(), by default the C library rand(), with no key and no binding to the client. An attacker who can predict the generator's output can pass the cookie exchange from a spoofed address and make the server send its handshake flight to a victim, using it as a traffic reflector.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netxduo
CVE-2026-102722

The FTP client trusts arbitrary IP addresses in the PASV server response

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever address the server names in its 227 reply instead of the server it is talking to. A malicious FTP server can make the client connect to any host and port the device can reach, using it to scan the internal network and to deliver uploads to internal services.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102721

TFTP client and server copy the ERROR packet message without bounding the read against the packet

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet without bounding the copy by the end of the datagram, and the TFTP server reads one byte past a minimal ERROR packet. A malicious TFTP server can make the client copy up to 64 bytes of adjacent packet-pool memory into the error string the application retrieves, or fault on targets with memory protection.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo
CVE-2026-102720

DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its read pointer for every option it skips. A DHCP server, or any host on the link that answers first, can make the client read up to about a kilobyte past the received message, and the same walk copies out-of-bounds bytes into the application's buffer when it retrieves a user option.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx Netx Duo
CVE-2026-102711

Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain access to, the memory that follows it, and can place its entry points outside its code.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx/threadx
CVE-2026-89293

Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering

In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Eclipse Mnestix
CVE-2026-115231

User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Threadx