Live › vulnerability › CVE-2026-92853
Go to dashboardNetX Secure's TLS 1.3 Certificate parser decrements message_length without checking it, so a zero-length Certificate message wraps to 0xFFFFFFFF and defeats the bounds check. A malicious TLS 1.3 server or on-path attacker can crash a connecting NetX Duo client before authentication. The same code is reached by servers that verify client certificates and by DTLS 1.3 clients. On embedded targets the over-read typically causes a hard fault or reset. The vendor says the bytes read stay inside the DER parser, so there is no direct disclosure path, and it does not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NetX Duo (Eclipse ThreadX) | vendor | <= 6.5.1.202602 | 6.5.2.202603 |
6.5.1.202602 with NetX Secure TLS 1.3 enabled (NX_SECURE_TLS_TLS_1_3_ENABLED)6.5.2.202603 and rebuild and reflash the firmwareEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer.
The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-92853")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.