The NetX Duo firmware contains an ABI mismatch in the MQTT WebSocket setter routine. This mismatch can cause a buffer under‑read or a use‑after‑free error, potentially leaking sensitive data from memory or causing the system to crash. The vulnerability directly impacts the confidentiality and availability of the device when it processes MQTT WebSocket connections.

Affected products are those running the Eclipse NetX Duo firmware. No specific vendor build or version numbers are listed in the advisory, so all deployments of NetX Duo that include the MQTT WebSocket component may be vulnerable until a patch is applied.

The CVSS score is 7.5, and the EPSS value is undefined, so the exact exploitation likelihood cannot be quantified. However, because the flaw can result in memory disclosure and a crash, the risk is considered significant. The vulnerability is not currently tracked in CISA’s KEV catalog, and based on the description it is inferred that an attacker could exploit it by injecting crafted MQTT messages over a WebSocket connection to a NetX Duo device, leading to information leakage or a denial‑of‑service condition.