Aller au contenu
en Se connecter
9.3 Critique

CVE-2026-102761 NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained…

Description

NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet's unused payload area and on through the second packet's `NX_PACKET` control block. The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.

Produits et versions touchés

Produit Versions touchées Corrigé en
NetX Duo 6.5 premières → < 6.5.2.202603 6.5.2.202603
NetX Duo 6.2 6.2.0 → 6.5.1.202602 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de NetX Duo

Les 32 CVE de NetX Duo →
CVE-2026-106465 Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server 6.9 Moyenne CVE-2026-106464 Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing 8.7 Élevée CVE-2026-103415 When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without… 9.3 Critique CVE-2026-102717 MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash 7.5 Élevée
Suivre cette CVE