CVE-2026-102727

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102727", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-09-29T16:15:21.555Z", "datePublished": "2026-09-29T17:57:37.322Z", "dateUpdated": "2026-11-04T10:38:17.017Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-11-04T10:38:17.017Z"}, "title": "FTP Passive Data Connection Not Bound to the Authenticated Control Peer", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-923", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints", "type": "CWE"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse ThreadX NetX Duo", "versions": [{"status": "affected", "version": "6.0", "lessThanOrEqual": "6.5.2.202603a", "versionType": "custom"}, {"status": "unaffected", "version": "6.5.2.202603b", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without checking that it comes from the client that requested passive mode. An unauthenticated network attacker who connects to the predictable port first receives the file an authenticated user downloads, or supplies the content of the file the user uploads.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without checking that it comes from the client that requested passive mode. An unauthenticated network attacker who connects to the predictable port first receives the file an authenticated user downloads, or supplies the content of the file the user uploads.</p>"}]}], "references": [{"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-r2qx-83vg-xqx4"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "VulnCheck", "type": "coordinator"}, {"lang": "en", "value": "max-r-b", "type": "finder"}, {"lang": "en", "value": "enitmar", "type": "finder"}, {"lang": "en", "value": "Fr\u00e9d\u00e9ric Desbiens", "type": "remediation developer"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T18:30:27.649139Z", "id": "CVE-2026-102727", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T18:30:42.746Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102727", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-29T18:30:27.649139Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T18:30:33.189Z"}}], "cna": {"title": "FTP Passive Data Connection Not Bound to the Authenticated Control Peer", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "coordinator", "value": "VulnCheck"}, {"lang": "en", "type": "finder", "value": "max-r-b"}, {"lang": "en", "type": "finder", "value": "enitmar"}, {"lang": "en", "type": "remediation developer", "value": "Fr\u00e9d\u00e9ric Desbiens"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse ThreadX NetX Duo", "versions": [{"status": "affected", "version": "6.0", "versionType": "custom", "lessThanOrEqual": "6.5.2.202603a"}, {"status": "unaffected", "version": "6.5.2.202603b", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-r2qx-83vg-xqx4"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without checking that it comes from the client that requested passive mode. An unauthenticated network attacker who connects to the predictable port first receives the file an authenticated user downloads, or supplies the content of the file the user uploads.", "supportingMedia": [{"type": "text/html", "value": "<p>In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without checking that it comes from the client that requested passive mode. An unauthenticated network attacker who connects to the predictable port first receives the file an authenticated user downloads, or supplies the content of the file the user uploads.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-923", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-11-04T10:38:17.017Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102727", "state": "PUBLISHED", "dateUpdated": "2026-11-04T10:38:17.017Z", "dateReserved": "2026-09-29T16:15:21.555Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2026-09-29T17:57:37.322Z", "assignerShortName": "eclipse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Eclipse ThreadX NetX Duo", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "6.5.2.202603a", "status": "affected", "version": "6.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.5.2.202603b", "versionType": "custom"}]}], "source": "emo@eclipse.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without checking that it comes from the client that requested passive mode. An unauthenticated network attacker who connects to the predictable port first receives the file an authenticated user downloads, or supplies the content of the file the user uploads."}], "id": "CVE-2026-102727", "lastModified": "2026-11-04T11:17:11.553", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "emo@eclipse.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102727", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-29T18:30:27.649139Z", "version": "2.0.3"}}]}, "published": "2026-09-29T18:17:12.363", "references": [{"source": "emo@eclipse.org", "url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-r2qx-83vg-xqx4"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-923"}], "source": "emo@eclipse.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.5.1.202602]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "netx_duo", "vendor": "eclipse"}], "created": "2026-09-29T22:45:18.600604+00:00", "updated": "2026-11-04T15:00:19.498873+00:00", "vendors": ["eclipse", "eclipse$PRODUCT$netx_duo"]}