NetX Duo's WebSocket client contains a buffer overflow that allows an attacker to overwrite memory by sending a masked frame that spans two packet buffers. The client resets the unmasking cursor to the beginning of the first packet while the XOR loop remains bounded by the size of the current packet, causing the loop to continue into the next packet's control block. Because the four‑byte masking key is under the attacker's control, the corruption is attacker‑chosen and can overwrite arbitrary locations, potentially leading to code execution or denial of service.

The affected software is the Eclipse Foundation NetX Duo WebSocket client, used in embedded systems. No specific version numbers are published in the advisory. The flaw may affect any build that includes the WebSocket implementation described.

The CVSS score of 9.3 indicates a very high severity, while the EPSS score is not available, so the current exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog. It can be triggered remotely by an attacker who can send a crafted WebSocket frame to the target device over the network, and no authentication or elevated privileges are required on the client.