IT SBIT Services
Schneeberger
DEEN
CVE tracker

Eclipse ThreadX NetX Duo: Out-of-bounds write via unbounded RSA modulus in NetX Secure

CVE-2026-93475Critical 9.3

← All vulnerabilities

Summary

NetX Secure, the TLS/DTLS component of Eclipse ThreadX NetX Duo, accepts RSA keys of any size during X.509 certificate parsing, but the signature verification buffers are sized for 4096-bit moduli. A certificate chain carrying an oversized RSA key causes an out-of-bounds write during chain verification. An unauthenticated remote attacker can trigger this by presenting a malicious certificate chain to a TLS/DTLS client or to a server using client-certificate authentication, which may lead to memory corruption and potentially code execution. CVSS 4.0 base score 9.3 (Critical) as assigned by the CNA; no known exploitation.

Affected

  • Eclipse ThreadX NetX Duo (NetX Secure) versions 0 to 6.5.1.202602 (inclusive)
  • Affected configurations: TLS and DTLS clients verifying peer chains, and servers performing client-certificate authentication
  • Devices embedding NetX Secure may ship their own firmware versions; affected status depends on the vendor build

Fixed in

  • NetX Duo 6.5.2.202603 (marked unaffected in the CVE record and advisory)
  • Hotfix v6.5.2.202603a_rel exists, but it is unverified whether it contains this fix

Workaround

  • None. Disabling certificate-chain verification is not a mitigation.

Exploitation

  • No known exploitation in the wild found.
  • No public proof of concept or exploit available.
  • CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
  • CISA KEV status: unknown.

Our recommendation

  • Inventory devices and firmware that use NetX Duo or NetX Secure; ask device vendors which versions they ship.
  • Update to NetX Duo 6.5.2.202603 or a vendor firmware that includes the fix; verify the fix in the GitHub advisory.
  • Restrict network exposure of affected devices, especially internet-reachable or segment-crossing ones, until patched.
  • Monitor vendor advisories for firmware updates.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:05.

Original description (NVD)

The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed