CVE-2026-102713

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in NetX Duo TFTP Server

Publication date: 2026-09-29

Last updated on: 2026-11-04

Assigner: Eclipse Foundation

Description

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the received packet into the file and read it back by downloading the file, and the same datagram can suspend the server thread permanently.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-09-29

EPSS Evaluated

2026-11-07

NVD

CVE-2026-102713

EUVD

EUVD-2026-89176

Affected Vendors & Products

Vendor	Product	Version / Range
azure	azure_tftp_server	*
azure	filex	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a TFTP server that does not enforce an upper limit on the size of DATA datagrams. The server copies data from packets without checking if the size exceeds protocol limits, leading to heap buffer overflows. Attackers can exploit this to write arbitrary data into files and retrieve sensitive memory contents via TFTP read requests. The server may also crash or hang due to resource exhaustion.

Detection Guidance

This vulnerability involves a TFTP server accepting oversized DATA datagrams without proper size checks, leading to memory disclosure and server wedging. Detection requires monitoring TFTP server behavior for crashes or unusual memory usage when receiving large packets. Check server logs for heap-buffer-overflow errors or timeouts. Use network monitoring tools like Wireshark to capture and analyze TFTP traffic for excessively large packets.

Impact Analysis

An attacker could exploit this to read sensitive memory from the server, potentially exposing confidential data. The server may become unresponsive or crash, disrupting services. Since TFTP lacks authentication, any remote attacker can exploit this without credentials.

Compliance Impact

This vulnerability allows memory disclosure and server denial-of-service, which could lead to unauthorized data exposure or service disruption. Such risks may violate GDPR's data integrity and availability principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Update the TFTP server to a patched version that includes a check for nx_packet_length > 4 + NX_TFTP_FILE_TRANSFER_MAX in the DATA branch. Replace NX_WAIT_FOREVER with a bounded wait during nx_packet_copy to prevent server wedging.

Hi! I’m here to help you understand CVE-2026-102713. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...