NetX Duo: Out-of-bounds write in TLS 1.3 HelloRetryRequest handling
Summary
NetX Duo, the TCP/IP and TLS library of Eclipse ThreadX used in embedded and IoT devices, contains an out-of-bounds write in its TLS 1.3 client. A malicious or compromised server can send an oversized cookie in a HelloRetryRequest, and the client copies it into its second ClientHello without checking the packet size. The write happens before certificate authentication, so the attacker does not need a valid certificate. The attack requires a TLS 1.3 build with ECC ciphersuites enabled and a TLS packet buffer smaller than the cookie plus the other ClientHello fields.
Affected
- NetX Duo 6.0_rel through 6.5.1.202602 (affected range 0 to <= 6.5.1.202602).
- Only TLS 1.3 builds with ECC ciphersuites enabled, acting as a TLS client, are affected.
- Default builds with TLS 1.3 disabled are not affected.
- Only the client code path is affected.
Fixed in
- Fixed in NetX Duo 6.5.2.202603.
Workaround
- Unknown. No vendor workaround has been published.
- Restrict which servers affected devices can connect to, and place these devices behind network controls.
- Check whether TLS 1.3 is enabled in the device firmware.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- Not listed in the CISA Known Exploited Vulnerabilities catalog.
- No public proof of concept was found in our research.
- The reporter demonstrated control-flow redirection in a test layout; impact beyond a crash depends on the build and platform protections.
Our recommendation
- Identify embedded devices and firmware that use NetX Duo, and ask the device vendors for their NetX Duo version and patch plan.
- Prioritise devices that make outbound TLS connections to untrusted endpoints.
- Apply vendor firmware updates containing NetX Duo 6.5.2.202603 or later as soon as they are available.
- Restrict and monitor outbound connections from affected devices until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5pv3-rhf5-gwgq (Eclipse ThreadX) github.com
- Eclipse CVE assignment work item #357 gitlab.eclipse.org
- VulDB entry 420276 vuldb.com
- OpenCVE CVE-2026-103415 app.opencve.io
- Vulners VulnRichment CVE-2026-103415 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:47.
Original description (NVD)
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.