Description
A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a



kilobyte past the end of the received message.



The option walk keeps a pointer and an offset in step, and the only bound check uses the offset:



```c



/* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */



while (i < length - 1)



{

...
size = *(++data); /* data moves 1: type -> length byte */
data += size + 1; /* data moves size + 1 more */
i += size + 1; /* i moves only size + 1 */


}



```



A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so



the offset falls one byte behind the real read position for every option the walk skips. After



enough skipped options the check `i < length - 1` still holds while `data` is already past the end



of the message, and the subsequent read of the type and length bytes comes from whatever follows.



A single OFFER carrying a long run of skippable options is enough:



```



ERROR: AddressSanitizer: heap-buffer-overflow



READ of size 1 at 0x61b000000794 thread T5

#0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7541
#1 _nx_dhcp_get_option_value addons/dhcp/nxd_dhcp_client.c:7082


0x61b000000794 is located 164 bytes to the right of 1648-byte region



```



A well formed OFFER through the same path is handled normally, the client records the offer and



moves to REQUESTING, so the difference is the option layout rather than the harness.



The read runs in the DHCP client thread while the client is still unconfigured, so it happens on



every boot in reach of a hostile DHCP responder. The values read are used to configure the



interface, which is how the disclosed bytes become observable.



Advance `i` by size + 2, or derive the bound from `data` rather than keeping a second counter.
Published: 2026-09-29
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The DHCP client in Eclipse ThreadX/NetX Duo incorrectly walks through TLV options, allowing a malicious OFFER to bypass bounds checks and read past the end of a message; this heap-buffer-overflow can corrupt memory used for interface configuration and may enable arbitrary code execution on the affected device.

Affected Systems

The vulnerability affects the Eclipse ThreadX/NetX Duo product family; specific version information is not supplied in the advisory, so all releases of NetX Duo that include the uncovered code path are at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity weakness, and the lack of an EPSS entry shows no known exploitation probability yet; the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local – an attacker who can send crafted DHCP traffic on the same LAN can trigger the overflow at boot time, potentially compromising the device before it fully starts. An attacker could alter configuration, crash the client, or execute arbitrary code depending on the memory state of the process.

Generated by OpenCVE AI on September 29, 2026 at 21:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Eclipse ThreadX/NetX Duo patch or updated firmware that fixes the DHCP option parsing logic
  • Temporarily disable the DHCP client or set a static IP configuration until the patch is installed to prevent the overflow on boot
  • Configure the network environment to block unsolicited DHCP responses or use DHCP snooping on switches to mitigate attempts from unauthorized hosts

Generated by OpenCVE AI on September 29, 2026 at 21:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse threadx Netx Duo
Vendors & Products Eclipse
Eclipse threadx Netx Duo

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received message. The option walk keeps a pointer and an offset in step, and the only bound check uses the offset: ```c /* addons/dhcp/nxd_dhcp_client.c:7538, 7572 */ while (i < length - 1) { ... size = *(++data); /* data moves 1: type -> length byte */ data += size + 1; /* data moves size + 1 more */ i += size + 1; /* i moves only size + 1 */ } ``` A TLV option occupies size + 2 bytes. `data` is advanced by size + 2 in total, `i` by size + 1, so the offset falls one byte behind the real read position for every option the walk skips. After enough skipped options the check `i < length - 1` still holds while `data` is already past the end of the message, and the subsequent read of the type and length bytes comes from whatever follows. A single OFFER carrying a long run of skippable options is enough: ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 at 0x61b000000794 thread T5 #0 _nx_dhcp_search_buffer addons/dhcp/nxd_dhcp_client.c:7541 #1 _nx_dhcp_get_option_value addons/dhcp/nxd_dhcp_client.c:7082 0x61b000000794 is located 164 bytes to the right of 1648-byte region ``` A well formed OFFER through the same path is handled normally, the client records the offer and moves to REQUESTING, so the difference is the option layout rather than the harness. The read runs in the DHCP client thread while the client is still unconfigured, so it happens on every boot in reach of a hostile DHCP responder. The values read are used to configure the interface, which is how the disclosed bytes become observable. Advance `i` by size + 2, or derive the bound from `data` rather than keeping a second counter.
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Threadx Netx Duo
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-09-29T18:37:07.341Z

Reserved: 2026-09-29T16:15:16.300Z

Link: CVE-2026-102720

cve-icon Vulnrichment

Updated: 2026-09-29T18:37:04.247Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:11.377

Modified: 2026-09-29T19:17:21.203

Link: CVE-2026-102720

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T00:30:17Z

Weaknesses