Netx Duo
32 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Netx Duo, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Netx Duo CVEs per month
| Month | CVEs |
|---|---|
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 11 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 18 |
| 2026-10 | 3 |
| 2026-11 | 0 |
Severity
How the 32 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High5
- Medium8
Latest CVEs
The 15 most recently published vulnerabilities affecting Netx Duo.
- CVE-2026-106465The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes ove...—
- CVE-2026-106464`_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking that `tlv_length` is non-zero. A certificate whose signature is an empt...—
- CVE-2026-103415When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the ...—
- CVE-2026-102717MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash7.5
- CVE-2026-102727FTP Passive Data Connection Not Bound to the Authenticated Control Peer—
- CVE-2026-102728Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bound...7.5
- CVE-2026-102726Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read—
- CVE-2026-102725Out-of-bounds Read from Unvalidated MSRP Attribute List Length—
- CVE-2026-102724NULL Pointer Dereference When Evicting the Sole MSRP Attribute—
- CVE-2026-102723NULL Pointer Dereference on MSRP Attribute Table Exhaustion—
- CVE-2026-102722In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any a...—
- CVE-2026-102721A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes lo...—
- CVE-2026-102718hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so ...—
- CVE-2026-102714`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one- or two-byte residue exits the loop w...—
- CVE-2026-102713The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular n...—
Product grouping is registry-driven, with AI assist and human review. How it works