Netxduo
Source repositories
CVEs (31)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-102721 | Med | 0.45 | — | 0.00 | Sep 29, 2026 | A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229, 1521, 1984). When the opcode is NX_TFTP_CODE_ERROR… | ||
| CVE-2026-102759 | Med | 0.41 | — | 0.00 | Sep 29, 2026 | NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted application record whose length equals the negotiated MAC size is treated as valid and returns success after advancing the receive… | ||
| CVE-2026-102719 | Med | 0.41 | — | 0.00 | Sep 29, 2026 | Predictable DTLS HelloVerifyRequest Cookie in NetX Secure | ||
| CVE-2026-102727 | Med | 0.39 | — | 0.00 | Sep 29, 2026 | FTP Passive Data Connection Not Bound to the Authenticated Control Peer | ||
| CVE-2026-102726 | Med | 0.39 | — | 0.00 | Sep 29, 2026 | Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read | ||
| CVE-2026-102725 | Med | 0.39 | — | 0.00 | Sep 29, 2026 | Out-of-bounds Read from Unvalidated MSRP Attribute List Length | ||
| CVE-2026-102724 | Med | 0.39 | — | 0.00 | Sep 29, 2026 | NULL Pointer Dereference When Evicting the Sole MSRP Attribute | ||
| CVE-2026-102723 | Med | 0.39 | — | 0.00 | Sep 29, 2026 | NULL Pointer Dereference on MSRP Attribute Table Exhaustion | ||
| CVE-2026-93003 | Med | 0.38 | — | 0.00 | Oct 20, 2026 | The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control… | ||
| CVE-2026-102720 | Med | 0.34 | — | 0.00 | Sep 29, 2026 | A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: ```c /*… | ||
| CVE-2025-55084 | Med | 0.34 | 5.3 | 0.00 | Oct 16, 2025 | In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_versions_extension() in the extension version field. |
- risk 0.45cvss —epss 0.00
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229, 1521, 1984). When the opcode is NX_TFTP_CODE_ERROR…
- risk 0.41cvss —epss 0.00
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted application record whose length equals the negotiated MAC size is treated as valid and returns success after advancing the receive…
- risk 0.41cvss —epss 0.00
Predictable DTLS HelloVerifyRequest Cookie in NetX Secure
- risk 0.39cvss —epss 0.00
FTP Passive Data Connection Not Bound to the Authenticated Control Peer
- risk 0.39cvss —epss 0.00
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
- risk 0.39cvss —epss 0.00
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
- risk 0.39cvss —epss 0.00
NULL Pointer Dereference When Evicting the Sole MSRP Attribute
- risk 0.39cvss —epss 0.00
NULL Pointer Dereference on MSRP Attribute Table Exhaustion
- risk 0.38cvss —epss 0.00
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control…
- risk 0.34cvss —epss 0.00
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: ```c /*…
- risk 0.34cvss 5.3epss 0.00
In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_versions_extension() in the extension version field.
Page 2 of 2