NetX Duo: Missing cookie validation in DTLS server allows spoofed handshakes
Summary
NetX Duo is an embedded TCP/IP stack from the Eclipse Foundation that runs in device firmware. The DTLS server never checks the HelloVerifyRequest cookie returned by the client, and a first ClientHello with any cookie byte skips the source address verification. A remote, unauthenticated attacker can exhaust the server's session pool to cause a denial of service, or use the server to send amplified traffic to a spoofed victim address. Confidentiality and integrity are not affected.
Affected
- NetX Duo releases up to and including 6.5.2.202603
- Any build providing a NetX Secure DTLS server
Fixed in
- NetX Duo 6.5.2.202603a
Workaround
Unknown. The vendor documents no interim workaround. Ingress filtering against source address spoofing and limits on sessions per peer reduce exposure but do not fix the flaw.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- Not listed in CISA KEV
- EPSS about 0.003 (low)
- No public proof of concept found; status unknown
Our recommendation
- Identify devices and firmware that use NetX Duo, together with the device vendors
- Ask vendors whether their firmware includes 6.5.2.202603a or later
- Restrict DTLS/UDP services to trusted networks until patched
- Monitor the vendor advisory and NVD for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7c5f-gmpm-f655 github.com
- NetX Duo release 6.5.2.202603a github.com
- Eclipse CVE assignment work item 379 gitlab.eclipse.org
- OpenCVE CVE-2026-106465 app.opencve.io
- VulnCheck/Vulners CVE-2026-106465 vulners.com
- EUVD-2026-101504 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:48.
Original description (NVD)
The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes over the value the server issued, and the server then decides whether the client has been verified from the cookie's length alone. A peer that puts any single cookie byte in its first ClientHello skips the verification exchange entirely, so the server has no return-routability check and completes handshakes for forged source addresses.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.