Description
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring one MSRP attribute and withdrawing it, and ordinary withdrawals by legitimate stations reach the same path.
Published: 2026-09-29
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A null pointer dereference occurs when NetX Duo evicts the sole MSRP attribute of an MRP participant's list in versions 6.4.0 through 6.5.2.202603a built with VLAN and SRP support. This flaw can crash the running application or service. An unauthenticated station on the same Layer 2 segment can trigger this by declaring and withdrawing one MSRP attribute, and legitimate stations may also reach the same path. The impact is limited to service disruption, but repeated exploitation could lead to denial of service in embedded or real‑time systems.

Affected Systems

The affected product is Eclipse ThreadX NetX Duo. Versions 6.4.0 through 6.5.2.202603a built with VLAN and SRP support are vulnerable. Any installation that performs MSRP attribute eviction on a shared Layer 2 segment may be affected.

Risk and Exploitability

The CVSS score of 7.1 indicates high risk. The EPSS score is < 1%, indicating very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker on the same Layer 2 segment can trigger the fault by declaring and withdrawing a single MSRP attribute; the attack requires only unauthenticated network access to the device. While the flaw does not enable code execution, repeated exploitation could be used for availability attacks.

Generated by OpenCVE AI on November 4, 2026 at 14:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch for NetX Duo as soon as it is released
  • If a patch is not yet available, restrict or disable any functionality that triggers MSRP attribute eviction, limiting exposure to privileged processes
  • Configure monitoring to detect unexpected crashes or service restarts associated with MSRP operations

Generated by OpenCVE AI on November 4, 2026 at 14:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 10:45:00 +0000

Type Values Removed Values Added
Description NULL Pointer Dereference When Evicting the Sole MSRP Attribute In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fault the MRP worker thread by declaring one MSRP attribute and withdrawing it, and ordinary withdrawals by legitimate stations reach the same path.
Title Null Pointer Dereference During MSRP Attribute Eviction in NetX Duo NULL pointer dereference when evicting the last MSRP attribute in a participant's list
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse netx Duo
Vendors & Products Eclipse
Eclipse netx Duo

Tue, 29 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title Null Pointer Dereference During MSRP Attribute Eviction in NetX Duo

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description NULL Pointer Dereference When Evicting the Sole MSRP Attribute
Weaknesses CWE-476
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Netx Duo
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-11-04T10:28:13.150Z

Reserved: 2026-09-29T16:15:19.231Z

Link: CVE-2026-102724

cve-icon Vulnrichment

Updated: 2026-09-29T18:33:06.654Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:11.960

Modified: 2026-11-04T11:17:08.530

Link: CVE-2026-102724

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T15:00:19Z

Weaknesses