The NetX Secure DTLS server in Eclipse ThreadX NetX Duo, from version 6.0 to 6.5.2.202603a, creates HelloVerifyRequest cookies using NX_RAND() – which defaults to the C library rand() – without a cryptographic key or binding to the client in question. When an attacker can predict the output of this random generator, he can forge a HelloVerifyRequest from a spoofed address and trick the server into sending its DTLS handshake flight to a victim. This effectively turns the vulnerable device into a traffic reflector and can be abused to conduct denial‑of‑service attacks or reflect traffic back to a chosen target.

The affected product is NetX Duo from the Eclipse Foundation. Vulnerable releases are Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a. Firmware or software that contains these versions and has not applied a patch that mitigates the predictable HelloVerifyRequest cookie is potentially exposed to the described attack.

The CVSS score of 6.3 classifies this weakness as medium severity, and the EPSS score of less than 1% indicates a low estimated probability of exploitation. It has not been listed in the CISA KEV catalog, suggesting no widely published attacks at this time. Nevertheless, the vulnerability permits an attacker to send crafted HelloVerifyRequest messages from a spoofed address, causing the DTLS server to proxy handshake packets to a victim, thus enabling a reflection‑based denial‑of‑service attack or a traffic‑snowball scenario. This can be executed over the public network and requires only the ability to initiate DTLS sessions with the targeted device.