6.3
Medium
CVE-2026-102719 NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check
Description
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(), by default the C library rand(), with no key and no binding to the client. An attacker who can predict the generator's output can pass the cookie exchange from a spoofed address and make the server send its handshake flight to a victim, using it as a traffic reflector.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:LExploitable remotely over the network, without an account and without any user action; with no direct impact on the vulnerable system.
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- None
- Privileges required
- None
- Interaction
- None
- Confidentiality
- None
- Integrity
- None
- Availability
- None
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| netxduo 6.5 | earliest → 6.5.1 | No fix stated |
| Eclipse ThreadX NetX Duo 6.5 | earliest → < 6.5.2.202603b | 6.5.2.202603b |
| Eclipse ThreadX NetX Duo 6.0 | 6.0 → 6.5.2.202603a | No fix stated |
References
- github.com github.com
Timeline
- Published
- Last modified