Description
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever address the server names in its 227 reply instead of the server it is talking to. A malicious FTP server can make the client connect to any host and port the device can reach, using it to scan the internal network and to deliver uploads to internal services.
Published: 2026-09-29
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized outbound connections via FTP PASV mode
Action: Update Client
AI Analysis

Impact

The FTP client in Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, when operating in IPv4 passive mode, opens its data connection to the IP address supplied by the server in the 227 reply rather than the address of the server it is communicating with. A malicious FTP server can supply any address and port, causing the client to connect to arbitrary hosts and ports that the device can reach. This allows the attacker to scan internal networks and deliver uploads to internal services.

Affected Systems

The affected product is Eclipse Foundation NetX Duo, specifically its FTP client implementation. Versions 6.0 through 6.5.2.202603a are affected, so any release within that range is impacted until the flaw is addressed.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. An EPSS score of <1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation in the wild. The likely attack vector is a malicious FTP server that can send a crafted PASV reply; this inference is based on the description of the flaw.

Generated by OpenCVE AI on November 4, 2026 at 14:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest NetX Duo firmware or software update that addresses the PASV reply validation flaw.
  • Configure the FTP client or underlying networking stack to validate IPv4 addresses received in 227 replies against expected address spaces and reject any unexpected values.
  • Deploy network monitoring or firewall rules to detect and block abnormal outbound connections originating from FTP clients, mitigating the impact of an accidental or malicious misconfiguration.

Generated by OpenCVE AI on November 4, 2026 at 14:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 09:45:00 +0000

Type Values Removed Values Added
Description In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there. In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever address the server names in its 227 reply instead of the server it is talking to. A malicious FTP server can make the client connect to any host and port the device can reach, using it to scan the internal network and to deliver uploads to internal services.
Title FTP Client accepts arbitrary IPv4 address from passive mode reply The FTP client trusts arbitrary IP addresses in the PASV server response
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse netx Duo
Vendors & Products Eclipse
Eclipse netx Duo

Tue, 29 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title FTP Client accepts arbitrary IPv4 address from passive mode reply

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.
Weaknesses CWE-918
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Netx Duo
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-11-04T09:50:18.031Z

Reserved: 2026-09-29T16:15:17.733Z

Link: CVE-2026-102722

cve-icon Vulnrichment

Updated: 2026-09-29T18:34:35.914Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:11.693

Modified: 2026-11-04T10:17:24.010

Link: CVE-2026-102722

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T15:00:19Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)