Skip to content
fr Sign in
9.3 Critical

CVE-2026-102761 NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained…

Description

NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet's unused payload area and on through the second packet's `NX_PACKET` control block. The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.

Affected products and versions

Product Affected versions Fixed in
NetX Duo 6.5 earliest → < 6.5.2.202603 6.5.2.202603
NetX Duo 6.2 6.2.0 → 6.5.1.202602 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of NetX Duo

The 32 CVEs of NetX Duo →
CVE-2026-106465 Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server 6.9 Medium CVE-2026-106464 Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing 8.7 High CVE-2026-103415 When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without… 9.3 Critical CVE-2026-102717 MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash 7.5 High
Track this CVE