The NetX Duo Secure DTLS server issues a HelloVerifyRequest with a cookie but fails to compare the cookie a client returns to the one it issued, treating any non‑empty cookie as verified. As a result, a client can send a single arbitrary cookie byte in its first ClientHello, causing the server to skip the verification exchange entirely. This flaw permits the server to accept DTLS handshakes that originate from spoofed source addresses, effectively turning the authentication mechanism into a no‑op and enabling attackers to initiate unauthorized TLS sessions. Moreover, a remote attacker can force the server to transmit its full handshake flight—a several‑kilobyte packet—to a forged source address, creating an amplification reflection vector against a third party.

Eclipse Foundation’s NetX Duo real‑time operating system is affected. Versions 6.0 through 6.5.2.202603 do not properly validate HelloVerifyRequest cookies and are vulnerable.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity. Its EPSS score is < 1%, suggesting a very low probability of exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. The likely attack vector is network‑based; the absence of cookie validation opens the server’s trust boundary, allowing attackers to spoof source addresses and potentially amplify traffic to a third party.