Eclipse ThreadX NetX Duo: Out-of-bounds read in TLS 1.3 certificate parsing
Summary
NetX Duo, the TCP/IP stack for embedded devices, contains an out-of-bounds read in the TLS 1.3 Certificate message parser of NetX Secure. A zero-length Certificate message causes an unsigned length underflow, so the parser reads past the session packet buffer. An unauthenticated attacker acting as a malicious TLS 1.3 server or as an on-path party can crash a connecting client, which can cause a denial of service on the device. The vulnerability only applies to builds with TLS 1.3 enabled, and the vendor scores the impact as availability only.
Affected
- Eclipse ThreadX NetX Duo 0 to 6.5.1.202602 (according to the CNA record)
- Only builds with TLS 1.3 enabled are affected; TLS 1.3 is disabled by default
Fixed in
- Fixed in NetX Duo 6.5.2.202603 (CNA record and advisory GHSA-893m-9g4r-4992)
- Vendor firmware built on NetX Duo needs the update from the device manufacturer
Workaround
- Build without TLS 1.3 support, which removes the affected code path
- Restrict network access to affected devices
Exploitation
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial
- No public proof of concept and no reports of in-the-wild exploitation were found in the sources
- Not listed in the CISA KEV catalog at the time of research
Our recommendation
- Inventory devices and firmware that use NetX Duo
- Ask device vendors for firmware that includes the fix
- Update NetX Duo to 6.5.2.202603 or later where you build your own firmware
- Disable TLS 1.3 where it is not required
- Restrict network access to affected devices and monitor them for crashes or resets
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-893m-9g4r-4992 github.com
- NetX Duo release 6.5.2.202603 github.com
- NetX Duo pull request 472 github.com
- NetX Duo hotfix release 6.5.2.202603a github.com
- OpenCVE CVE-2026-92853 app.opencve.io
- NetX Secure TLS documentation 6.5.1 threadx.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:30.
Original description (NVD)
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer. The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.