Live › vulnerability › CVE-2026-114408
NetX Duo's IPv6 path MTU handling does not check whether it added a destination entry, so a flood of forged ICMPv6 Packet Too Big messages can leave a NULL pointer dereference. On targets that fault on address 0, the IP helper thread crashes and all network processing stops.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Only embedded devices built with NetX Duo in the listed versions and with IPv6 path MTU discovery enabled are exposed. An attacker on the same network segment can send the crafted ICMPv6 messages, so devices reachable only from trusted networks carry less risk. unknown for whether any particular product ships this build.
No product ranges from the sources yet.
6.4.5.202504 through 6.5.2.202603a.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing.
This page as .md · .json · in your agent: get_signal("CVE-2026-114408")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.