The vulnerability arises when NetX Secure is configured with NX_SECURE_KEY_CLEAR; each TLS record is wiped after being passed to TCP, but the TCP layer may have already released the packet buffer. The wipe writes zeros into buffers that might be free or in use by another thread, causing an underflow when the zeroing length is evaluated and the operation runs past the end of the packet pool. This corruption can lead to memory overwrite and potentially allow an attacker to execute arbitrary code or crash the system.

Eclipse Foundation’s NetX Duo product is affected. No specific version numbers are listed in the advisory; affected builds are those compiled with the NX_SECURE_KEY_CLEAR option enabled.

With a CVSS score of 8.3 the vulnerability is classified as High severity. EPSS data is not available and the issue is not listed in CISA KEV, indicating it has not been widely exploited yet. The likely attack vector is a network-based attack that induces the vulnerable TLS handling path, such as sending crafted TLS records to a device running the affected firmware. Successful exploitation would require triggering the memory corruption and influencing the execution flow, which could result in remote code execution or a denial of service.