SB20261109162 - Multiple vulnerabilities in NetX Duo

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109162

SB20261109162 - Multiple vulnerabilities in NetX Duo

Published: November 9, 2026

Security Bulletin ID SB20261109162
CSH Severity
High
Patch available
YES
Number of vulnerabilities 15
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 27% Medium 73%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 15 vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2026-102760)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash a device running NetX Duo, causing denial of service.

The vulnerability exists due to a use-after-free in the NetX Secure TLS record send path when the non-default NX_SECURE_KEY_CLEAR option clears packets after TCP takes ownership. An unauthenticated remote attacker can trigger multi-packet TLS responses that corrupt memory if another thread reallocates freed packets before clearing completes.


2) Memory leak (CVE-ID: CVE-2026-102762)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to stop all inbound network traffic on a device until reboot.

The vulnerability exists due to unreleased receive packets in the NetX Duo MQTT client when processing malformed PUBLISH messages. An unauthenticated remote attacker can exhaust the receive pool by repeatedly sending these messages as the connected broker or by injecting them into the client's plain TCP stream.


3) Out-of-bounds write (CVE-ID: CVE-2026-103416)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash a NetX Duo TLS client or corrupt its session data.

The vulnerability exists due to an unchecked copy into NetX Secure's fixed-size handshake cache when TLS 1.3 is explicitly enabled with ECC ciphersuites and a HelloRetryRequest produces an oversized ClientHello. An unauthenticated remote attacker can control or impersonate the client's server and send an oversized cookie to trigger the out-of-bounds write before certificate authentication.


4) Out-of-bounds write (CVE-ID: CVE-2026-103415)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to corrupt memory in NetX Duo TLS clients before certificate authentication.

The vulnerability exists due to unchecked copying of HelloRetryRequest cookies into the second ClientHello packet when TLS 1.3 is explicitly enabled and ECC ciphersuites are enabled. An unauthenticated remote attacker can impersonate the client's endpoint and supply a cookie exceeding the outgoing packet's capacity, overwriting adjacent memory and executing an attacker-selected callback in a demonstrated test layout.


5) Out-of-bounds write (CVE-ID: CVE-2026-93475)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to corrupt memory during peer certificate verification.

The vulnerability exists due to missing RSA modulus size validation in NetX Duo's NetX Secure X.509 processing when certificate-chain verification writes into fixed-size buffers. An unauthenticated remote attacker can present a chain containing an oversized intermediate RSA key to a TLS or DTLS client, or a server with client-certificate authentication enabled, causing an out-of-bounds write before authentication.


6) Out-of-bounds read (CVE-ID: CVE-2026-102717)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to obtain unrelated process memory or cause a denial of service.

The vulnerability exists due to an ABI mismatch that leaves bearer arguments uninitialized in NetX Duo when NXD_MQTT_OVER_WEBSOCKET is enabled and the application calls nxd_mqtt_client_websocket_set. An unauthenticated remote attacker acting as the configured WebSocket peer can receive memory as bearer credentials during a subsequent connection, with disclosure or a crash depending on unpredictable runtime state.


7) Improper validation of integrity check value (CVE-ID: CVE-2026-102759)

CWE-ID: CWE-354 - Improper Validation of Integrity Check Value

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated network attacker to disrupt established TLS connections, causing denial of service.

The vulnerability exists due to NetX Secure TLS skipping message authentication code verification for empty application records when negotiating TLS 1.2 or earlier with separate record MACs. An unauthenticated network attacker can modify or replay ciphertext on an established session to have an altered empty record accepted and advance the receiver's sequence state.


8) Out-of-bounds write (CVE-ID: CVE-2026-102761)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to hijack control flow on devices using NetX Duo's WebSocket client.

The vulnerability exists due to an out-of-bounds write when the unmasking cursor restarts at the first packet while processing a masked frame spanning chained packets. An unauthenticated remote attacker can send such a frame from a connected hostile endpoint to corrupt packet metadata and redirect execution where the packet-pool and executable layouts permit.


9) Out-of-bounds read (CVE-ID: CVE-2026-92853)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash NetX Duo devices with TLS 1.3 enabled, denying service.

The vulnerability exists due to an unchecked length decrement that causes unsigned underflow in the NetX Secure Certificate-message parser when processing a zero-length Certificate message. An unauthenticated remote attacker can send this message before authentication to a connecting TLS 1.3 or DTLS 1.3 client, or a TLS 1.3 server with client-certificate verification enabled, triggering an out-of-bounds read and a device fault or reset.


10) Buffer over-read (CVE-ID: CVE-2026-102758)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to trigger a one-byte out-of-bounds read during TLS certificate parsing.

The vulnerability exists due to NetX Duo's NetX Secure ASN.1 parser reading a tag before checking whether the remaining certificate buffer length is zero. An unauthenticated remote attacker can send a crafted X.509 certificate that exhausts the buffer before a subsequent parsing operation, causing a read past its end before authentication.


11) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-106465)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to reflect amplified DTLS handshake traffic toward a third party, reducing the victim's network availability.

The vulnerability exists due to missing cookie validation in the NetX Secure DTLS server in NetX Duo, which accepts any nonempty cookie in a ClientHello. An unauthenticated remote attacker can send an initial ClientHello with a one-byte cookie and a forged victim source address to trigger the server's full handshake response.


12) Out-of-bounds read (CVE-ID: CVE-2026-106464)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to trigger out-of-bounds reads during TLS certificate signature verification in NetX Duo.

The vulnerability exists due to an unchecked length subtraction in NetX Secure's X.509 parser when a certificate contains an empty signature BIT STRING, producing an oversized signature length. An unauthenticated remote attacker can supply this certificate to a TLS client or a TLS server configured to request client certificates, causing signature verification to read beyond the certificate buffer before authentication completes.


13) NULL pointer dereference (CVE-ID: CVE-2026-115403)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash a NetX Duo application.

The vulnerability exists due to an unchecked destination-table insertion failure causing a NULL pointer dereference in BSD raw IPv6 sending when the default router is unresolved. An unauthenticated remote attacker can fill the table using ICMPv6 Packet Too Big messages when IPv6 path MTU discovery is enabled, triggering a crash when the application sends to a new off-link destination through an IPv6 raw socket with IP_RAW_IPV6_HDRINCL enabled.


14) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-115215)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to exhaust the DTLS session pool and deny service to legitimate clients.

The vulnerability exists due to the NetX Duo Secure DTLS server allocating sessions for datagrams from unknown sources before cookie verification and retaining them after handshake timeout. An unauthenticated remote attacker can send one datagram per spoofed source address or port to occupy every session until the application resets them.


15) NULL pointer dereference (CVE-ID: CVE-2026-114408)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash the NetX Duo IP helper thread, causing denial of service.

The vulnerability exists due to an unchecked destination-table insertion failure in ICMPv6 Packet Too Big processing when the table is full, in builds with IPv6 and non-default path MTU discovery enabled. An unauthenticated remote attacker can send messages quoting distinct destinations to fill the table, then trigger a NULL pointer dereference with another message.


Remediation

Install update from vendor's website.

References