In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure-Nak without validating each option's length. A malicious PPP peer can stall the PPP thread indefinitely with a zero-length option, taking the link down, and can read back up to four bytes of packet-buffer memory per exchange with a short address option.

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Eclipse
  • Netx Duo

No data.

No data.

References
Link Providers
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-2wwp-ffgp-6ggj cve-icon cve-icon
History

Wed, 04 Nov 2026 11:00:00 +0000

Type Values Removed Values Added
Description Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure-Nak without validating each option's length. A malicious PPP peer can stall the PPP thread indefinitely with a zero-length option, taking the link down, and can read back up to four bytes of packet-buffer memory per exchange with a short address option.
Title Unbounded PPP IPCP Option Parsing in NetX Duo Leads to Worker Stall and Out‑of‑Bounds Read Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse netx Duo
Vendors & Products Eclipse
Eclipse netx Duo

Tue, 29 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Title Unbounded PPP IPCP Option Parsing in NetX Duo Leads to Worker Stall and Out‑of‑Bounds Read

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
Weaknesses CWE-125
CWE-835
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published: 2026-09-29T17:51:48.598Z

Updated: 2026-11-04T10:35:10.543Z

Reserved: 2026-09-29T16:15:20.789Z

Link: CVE-2026-102726

cve-icon Vulnrichment

Updated: 2026-09-29T18:31:25.431Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:12.227

Modified: 2026-11-04T11:17:10.540

Link: CVE-2026-102726

cve-icon Redhat

No data.