Vulnerability · Published Sep 29, 2026 · Assigned by eclipse

CVE-2026-102719NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check

Medium 6.3

In plain English

A medium-severity security flaw in Eclipse ThreadX NetX Duo from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.2%top 89.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(), by default the C library rand(), with no key and no binding to the client. An attacker who can predict the generator's output can pass the cookie exchange from a spoofed address and make the server send its handshake flight to a victim, using it as a traffic reflector.

Affected products (as reported)

Vendor	Product	Versions
Eclipse Foundation	Eclipse ThreadX NetX Duo	6.0 – through 6.5.2.202603a

Weakness: CWE-338 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L

References

https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-j6gx-3j6v-3hm4