Out-of-bounds read in NetX Duo - CVE-2026-92853
Published: November 9, 2026
Vulnerability identifier: #VU162963
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-92853
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to crash NetX Duo devices with TLS 1.3 enabled, denying service.
The vulnerability exists due to an unchecked length decrement that causes unsigned underflow in the NetX Secure Certificate-message parser when processing a zero-length Certificate message. An unauthenticated remote attacker can send this message before authentication to a connecting TLS 1.3 or DTLS 1.3 client, or a TLS 1.3 server with client-certificate verification enabled, triggering an out-of-bounds read and a device fault or reset.
Affected software
NetX Duo
How to mitigate CVE-2026-92853
Install security update from vendor's website.
NetX Duo - update to 6.5.2.202603