CVE-2026-102713

HighCVSS 8.3/10Last modified Nov 4, 2026

Description

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the received packet into the file and read it back by downloading the file, and the same datagram can suspend the server thread permanently.

Metrics

CVSS 4.0 8.3/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-125CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Eclipse FoundationEclipse ThreadX NetX Duo<= 6.5.2.202603

References

Timeline

Published
Sep 29, 2026
Last modified
Nov 4, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1027147.1In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area tCVE-2026-1027157.1In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for CVE-2026-1027168.7In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session heCVE-2026-1027177.5MQTT WebSocket setter ABI mismatch may disclose memory or cause a crashCVE-2026-1027188.7In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the reqCVE-2026-1027196.3In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(),CVE-2026-102726.5A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The impacted element is an CVE-2026-1027205.3In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its reaCVE-2026-1027216.9In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet without boundiCVE-2026-1027226.9In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever adCVE-2026-1027237.1In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through CVE-2026-1027247.1In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP par
CVE-2026-102713: High severity, CVSS 8.3 | Vulnix