First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-102717

HighCVSS 7.5/10Last modified Sep 30, 2026

Description

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125 CWE-457

Affected software

Vendor	Product	Versions
Eclipse Foundation	NetX Duo	>= 6.4.4, <= 6.5.1.202602

References

https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-hp64-f44f-wjw6

Timeline

Published: Sep 30, 2026
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1027188.7In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the req CVE-2026-1027196.3In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(),CVE-2026-102726.5A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The impacted element is an CVE-2026-1027205.3In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its rea CVE-2026-1027216.9In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet without boundi CVE-2026-1027226.9In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever ad CVE-2026-1027237.1In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through CVE-2026-1027247.1In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP par CVE-2026-1027257.1In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list l CVE-2026-1027267.1In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure-Nak without validating each opti CVE-2026-1027276.0In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without c CVE-2026-1027287.5In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS client's HelloVerif

CVE-2026-102717: High severity, CVSS 7.5 | Vulnix