5.3
Medium
CVE-2026-102720 DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer
Description
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its read pointer for every option it skips. A DHCP server, or any host on the link that answers first, can make the client read up to about a kilobyte past the received message, and the same walk copies out-of-bounds bytes into the application's buffer when it retrieves a user option.
CVSS 4.0 detail
Vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:NExploitable from the adjacent network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Adjacent network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- Interaction
- None
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse-threadx/netxduo 6.5 | earliest → 6.5.1 | No fix stated |
| Eclipse ThreadX NetX Duo 6.5 | earliest → < 6.5.2.202603b | 6.5.2.202603b |
| Eclipse ThreadX NetX Duo 6.0 | 6.0 → 6.5.2.202603a | No fix stated |
References
- github.com github.com
Timeline
- Published
- Last modified