{"affected":[{"defaultStatus":"unaffected","product":"Eclipse ThreadX NetX Duo","source":"CNA: eclipse","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"6.5.2.202603","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"6.5.2.202603a"}]}],"cveId":"CVE-2026-102713","cwes":["CWE-125","CWE-770"],"description":"In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the received packet into the file and read it back by downloading the file, and the same datagram can suspend the server thread permanently.","epss":{"date":"2026-11-03","percentile":0.2364,"score":0.00308},"exploits":[],"kev":null,"metrics":[{"score":8.3,"severity":"high","source":"CNA: eclipse","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793797430427,"publishedAt":1790703640067,"references":[{"source":"CNA: eclipse","tags":[],"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-wr79-332c-ff8f"}],"remediation":[],"revision":"67b84a2b16540f20dd7785dc20f3c330a39054b1b269a7252649fafcbcde0feb","sources":[{"modifiedAt":1793797430427,"name":"CNA: eclipse","retrievedAt":1793797698653,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102713"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793797778371,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102713"}],"ssvc":{"assessedAt":1790707452259,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall","updatedAt":1793797778371}