{"id":"CVE-2026-92853","kind":"vulnerability","aliases":["CVE-2026-92853"],"related":[],"title":"NetX Secure: zero-length TLS certificate message reads past packet buffer","description":"The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer.\n\n\n\nThe trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.","summary":"NetX Secure's TLS 1.3 Certificate parser decrements message_length without checking it, so a zero-length Certificate message wraps to 0xFFFFFFFF and defeats the bounds check. A malicious TLS 1.3 server or on-path attacker can crash a connecting NetX Duo client before authentication. The same code is reached by servers that verify client certificates and by DTLS 1.3 clients. On embedded targets the over-read typically causes a hard fault or reset. The vendor says the bytes read stay inside the DER parser, so there is no direct disclosure path, and it does not describe code execution.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetX Duo (Eclipse ThreadX)","fixed":["6.5.2.202603"],"affected":"<= 6.5.1.202602","ecosystem":"vendor"}],"ecosystems":[],"tags":["azure-rtos","dos","dtls","eclipse-threadx","embedded","infrastructure","iot","netx-duo","netx-secure","tls-1.3"],"not_affected_if":["no-tls-1.3-server","not-netx-secure","tls-1.3-disabled"],"how_to_check":"You are affected if your firmware uses Eclipse ThreadX NetX Duo <= 6.5.1.202602 with NetX Secure TLS 1.3 enabled (NX_SECURE_TLS_TLS_1_3_ENABLED). This applies to clients, to servers with client-certificate verification, and to DTLS 1.3 clients. Check the NetX Duo version in your source tree or SDK and look for _nx_secure_tls_process_remote_certificate without a message_length > 0 check before the decrement.","fix":"Upgrade NetX Duo to 6.5.2.202603 and rebuild and reflash the firmware. The only workaround is building without TLS 1.3 support; there is none inside a TLS 1.3 build.","status":"open","published_at":"2026-10-20T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:37:20+00:00","updated_at":"2026-10-24T00:12:40+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T22:37:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NetX Secure: zero-length TLS certificate message reads past packet buffer","impact":"medium","summary":"NetX Secure's TLS 1.3 parser decrements a zero message length without checking it, wrapping to 0xFFFFFFFF and causing reads past the session packet buffer. An unauthenticated remote attacker can trigger it with a four-byte handshake header, and the sources give no further impact detail.","category":"infrastructure","who_cares":["netx-secure","embedded","iot","azure-rtos"],"confidence":0.6,"needs_auth":"no","worst_case":"out-of-bounds memory read from the TLS session buffer, remote and unauthenticated","analyst_note":"Check the NVD entry and the Microsoft/Eclipse ThreadX advisory for affected NetX Secure versions, patched release, and whether an out-of-bounds read can lead to code execution.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-tls-1.3-server","not-netx-secure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000501,"input_tokens":2972,"output_tokens":408,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Microsoft/Eclipse ThreadX advisory for affected NetX Secure versions, patched release, and whether an out-of-bounds read can lead to code execution.","search":"'-1.3':41B '-2026':14A,17A '-92853':15A,18A '0xffffffff':64B,186C '1.3':46B,73B,103B,146C 'attack':79B 'authent':88B,224C 'azur':24B 'azure-rto':23B 'bound':68B,190C 'buffer':12A,204C 'byte':123B,162C,171C,211C 'caus':113B 'certif':7A,47B,60B,99B,148C,178C 'certificate-messag':147C 'check':53B,69B,191C 'client':86B,98B,104B 'code':91B,142B 'connect':83B 'context':161C 'crash':81B 'cryptograph':217C 'cve':13A,16A 'decrement':49B,154C 'defeat':66B 'der':128B 'describ':141B 'direct':134B 'disclosur':135B 'dos':26B 'dtls':27B,102B 'duo':20A,36B,85B 'eclips':29B 'eclipse':21A 'eclipse-threadx':28B 'embed':31B,106B 'establish':165C 'execut':143B 'fault':116B 'first':164C 'follow':193C 'four':210C 'four-byt':209C 'handshak':212C 'hard':115B 'header':213C 'infrastructur':32B 'insid':126B 'iot':33B 'length':5A,51B,59B,157C,177C,184C 'make':188C 'malici':71B 'messag':8A,50B,61B,149C,156C,168C,179C 'netx':1A,19A,35B,38B,42B,84B,152C 'netx-duo':34B 'netx-secur':37B 'on-path':76B 'over-read':109B 'packet':11A,203C 'parser':48B,129B,150C,198C 'past':10A,200C 'path':78B,136B 'pre':223C 'pre-authent':222C 'reach':93B 'reachabl':221C 'read':9A,111B,124B,199C 'requir':215C 'reset':118B 'rtos':25B 'say':121B 'secur':2A,39B,43B,153C 'send':196C 'server':74B,95B 'session':202C 'skip':159C,173C 'stay':125B 'target':107B 'therefor':180C 'threadx':22A,30B 'tls':6A,40B,45B,72B,145C 'trigger':206C 'typic':112B 'unsign':183C 'vacuous':194C 'valid':218C 'vendor':120B 'verifi':97B 'without':52B,163C 'wrap':62B,181C 'zero':4A,58B,176C 'zero-length':3A,57B,175C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92853","severity":null,"published_at":"2026-10-20T16:17:17+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92853:612","url":null,"severity":null,"published_at":"2026-10-24T00:12:40+00:00","modified_at":"2026-10-24T00:12:40+00:00","first_seen_at":"2026-10-24T00:12:40+00:00","fetched_at":"2026-10-24T00:12:40+00:00","note":"Read vendor GHSA-893m-9g4r-4992 (Eclipse ThreadX): impact is DoS (hard fault/reset), not code execution or disclosure; fixed in 6.5.2.202603. No exploitation or public PoC found; did not search social."}],"documents":[{"id":2474,"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-893m-9g4r-4992","title":"GHSA-893m-9g4r-4992: Out-of-bounds Read via zero-length TLS 1.3 Certificate message in NetX Secure","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2478,"url":"https://github.com/eclipse-threadx/netxduo/releases","title":"eclipse-threadx/netxduo releases (6.5.2.202603)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}