Vulnerability · Published Sep 29, 2026 · Assigned by eclipse
CVE-2026-102727FTP Passive Data Connection Not Bound to the Authenticated Control Peer
Medium 6.0
In plain English
A medium-severity security flaw in Eclipse ThreadX NetX Duo from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without checking that it comes from the client that requested passive mode. An unauthenticated network attacker who connects to the predictable port first receives the file an authenticated user downloads, or supplies the content of the file the user uploads.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse ThreadX NetX Duo | 6.0 – through 6.5.2.202603a |
Weakness: CWE-923 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N