Memory leak in NetX Duo - CVE-2026-102762
Published: November 9, 2026
Vulnerability identifier: #VU162956
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102762
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to stop all inbound network traffic on a device until reboot.
The vulnerability exists due to unreleased receive packets in the NetX Duo MQTT client when processing malformed PUBLISH messages. An unauthenticated remote attacker can exhaust the receive pool by repeatedly sending these messages as the connected broker or by injecting them into the client's plain TCP stream.
Affected software
NetX Duo
How to mitigate CVE-2026-102762
Install security update from vendor's website.
NetX Duo - update to 6.5.2.202603