CVE-2026-92853: Zero-Length Cert Trigger in NetX Duo Causes Pre-Auth Integer Wrap
A flaw in Eclipse ThreadX NetX Secure allows a zero-length certificate message to trigger an unsigned integer wrap, letting a parser read beyond packet boundaries before authentication.
Key points
- CVE-2026-92853 affects NetX Duo versions up to 6.5.1.202602 with a CVSS score of 8.7.
- The vulnerability is reachable pre-authentication and requires only a four-byte handshake header.
- The issue stems from a logic error where message length decrementing occurs without verifying byte existence.
Eclipse ThreadX NetX Secure contains a parser flaw that allows an out-of-bounds read before authentication. The defect exists in versions of NetX Duo up to 6.5.1.202602 and is tracked as CVE-2026-92853 with a high severity rating.
What happened
The National Vulnerabilities Database records CVE-2026-92853 as affecting the TLS 1.3 Certificate-message parser within NetX Secure. According to the NVD description, the parser logic decrements the message length to skip a context byte without first confirming that a byte exists to skip. This logic error creates a specific failure condition when the parser encounters a zero-length Certificate message.
The NVD notes that a zero-length message causes the unsigned length value to wrap to 0xFFFFFFFF. This large value renders the subsequent bounds check ineffective. The parser then proceeds to read data past the end of the session packet buffer. The National Vulnerabilities Database classifies this under CWE-125 and CWE-191, indicating an out-of-bounds read and integer wrap issues.
The trigger for this behavior is minimal. According to the NVD record, it requires only a four-byte handshake header. The source material states that no cryptographic validity is needed to reach this state. This means the flaw is accessible before any authentication process completes. The NVD specifies that this affects Eclipse Foundation Eclipse ThreadX - NetX Duo up to version 6.5.1.202602.
Why it matters
Security teams using NetX Duo in embedded or IoT environments face exposure to this pre-authentication flaw. Because the trigger requires only a four-byte header and no valid cryptographic material, an attacker can easily craft the necessary packet. The NVD assigns a CVSS score of 8.7 to this issue, categorizing it as high severity. This score reflects the ease of access and the potential for memory exposure.
The fact that the parser reads past the session packet buffer is significant. While the source material does not specify what data resides adjacent to the buffer, reading beyond allocated memory can reveal sensitive information or cause instability. The National Vulnerabilities Database highlights that this is a pre-authentication issue, meaning no user credentials or session tokens are required to exploit it. This lowers the barrier for potential attackers significantly.
Our take on the response
- Review inventory for devices running NetX Duo versions prior to 6.5.1.202602.
- Monitor network traffic for TLS 1.3 handshake anomalies, specifically zero-length certificate messages.
- Apply vendor patches immediately once Eclipse Foundation releases a confirmed fix.
- Isolate affected systems from untrusted networks until a patch is verified.
What defenders should look for
Teams usually start by inspecting TLS handshake logs on edge devices and load balancers. Look for certificate messages with zero length during the TLS 1.3 handshake phase. Check whether application crash dumps indicate memory access violations or buffer over-reads in the parsing logic. Examine network flows for repeated four-byte headers that do not complete normal authentication sequences. If such patterns appear, teams should verify if the endpoint is running vulnerable NetX Duo versions. Containment often involves restricting inbound connections to known good sources or disabling the specific TLS endpoint if possible.
What to do and how to stay safe: NetX Secure
- Verify if your systems run NetX Duo version 6.5.1.202602 or earlier.
- Monitor for TLS 1.3 handshake failures or errors related to certificate parsing.
- Apply the latest vendor updates once Eclipse Foundation releases a patch for CVE-2026-92853.
- Segment networks to limit exposure of embedded devices handling TLS traffic.
Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget
General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of NetX Duo are affected by CVE-2026-92853?
The vulnerability affects Eclipse ThreadX - NetX Duo up to version 6.5.1.202602.
Is authentication required to trigger this vulnerability?
No, the flaw is reachable pre-authentication and requires no cryptographic validity.
What is the CVSS score for this issue?
The National Vulnerabilities Database rates CVE-2026-92853 as 8.7, which is high severity.
