The flaw lies in NetX Duo’s client‑side TLS and DTLS handshake parsers, which read fields from a ServerHello or HelloVerifyRequest message before verifying that the message is long enough to contain those fields. By causing the client to read up to three additional bytes, a malicious or on‑path attacker can trigger a fault that may crash the client on targets with memory protection, effectively denying service.

Eclipse Foundation’s NetX Duo embedded networking stack. The advisory does not list specific firmware or library releases, so all current and future versions may be affected until a vendor fix is applied.

The vulnerability is reachable over the network when a client initiates a TLS or DTLS session with a malicious or malformed server; thus the attacker would need to supply crafted handshake messages. The CVSS score of 6.3 indicates medium severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in CISA KEV, implying no widespread, publicly known exploits yet, but the potential for a client crash warrants timely mitigation.