The flaw in NetX Duo’s TLS implementation allows an incoming empty application‑data record whose length equals the negotiated MAC size to be accepted without verifying its authentication tag. The verification function simply increments the sequence counter and reports success, but it never generates or compares a MAC. Because empty application‑data records are defined as legal and are emitted by TLS 1.0 clients as a BEAST mitigation, a malicious sender can inject or alter transmitted data without detection, leaking the ability to tamper with the encrypted stream.

The affected software is the Eclipse Foundation’s NetX Duo network‑stack. No specific version list was supplied by the CNA, so users should refer to the advisory link for the precise releases that contain the vulnerability. All deployments that enable TLS 1.0 or adopt the default record‑handling logic are potentially impacted.

With a CVSS score of 6.3 the vulnerability is rated as moderate severity. There is no EPSS score available, and the issue is not present in the CISA KEV catalog, indicating no known exploitation activity yet. The attack vector is remote over the network: a client or attacker can send an empty record that bypasses MAC verification, allowing integrity compromise of the TLS session and the potential manipulation or exfiltration of data.