CVE-2026-102718

Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the request without checking it against the bytes present, and reads past the end of the packet buffer. A remote, unauthenticated attacker can send a crafted SNMP request that makes the agent read adjacent memory into its OID state, faulting the agent on targets with memory protection.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. the OOB bytes are decoded as OID component values and written into the agents internal OID string buffer, corrupting agent state. on systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. on bare metal embedded systems without memory protection the read silently succeeds and corrupts the agents internal state with heap data. In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the request without checking it against the bytes present, and reads past the end of the packet buffer. A remote, unauthenticated attacker can send a crafted SNMP request that makes the agent read adjacent memory into its OID state, faulting the agent on targets with memory protection.
Title Out‑of‑Bounds Read in NetX Duo SNMP Addon Causes Denial of Service Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length
Weaknesses CWE-130
Type Values Removed Values Added
First Time appeared Eclipse
Eclipse netx Duo
Vendors & Products Eclipse
Eclipse netx Duo
Type Values Removed Values Added
Title Out‑of‑Bounds Read in NetX Duo SNMP Addon Causes Denial of Service
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. the OOB bytes are decoded as OID component values and written into the agents internal OID string buffer, corrupting agent state. on systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. on bare metal embedded systems without memory protection the read silently succeeds and corrupts the agents internal state with heap data.
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
eclipse
Published
Updated
Nov 4, 2026, 1:18 PM
Reserved
Sep 29, 2026, 4:15 PM

View source JSON

Updated
Sep 29, 2026, 6:40 PM

JSON

Status
Awaiting Analysis
Published
Sep 29, 2026, 6:17 PM
Modified
Nov 4, 2026, 2:17 PM

View source JSON

No data.

Updated
Nov 4, 2026, 3:15 PM

JSON