CVE-2026-102718

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in NetX Duo SNMP Addon via BER Multibyte OID Length

Publication date: 2026-09-29

Last updated on: 2026-11-04

Assigner: Eclipse Foundation

Description

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the request without checking it against the bytes present, and reads past the end of the packet buffer. A remote, unauthenticated attacker can send a crafted SNMP request that makes the agent read adjacent memory into its OID state, faulting the agent on targets with memory protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-09-29

EPSS Evaluated

2026-11-07

NVD

CVE-2026-102718

EUVD

EUVD-2026-89181

Affected Vendors & Products

Vendor	Product	Version / Range
netx	duo_snmp_addon	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-130	The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

Executive Summary

This vulnerability is in the NetX Duo SNMP addon. The function `_nx_snmp_utility_object_id_get` fails to validate the OID data length against the buffer size when using BER multibyte length encoding. A remote attacker can exploit this by sending a crafted SNMP packet with a multibyte OID length larger than the buffer, causing the parser to read past the packet boundary into adjacent heap memory. This leads to heap corruption as the out-of-bounds bytes are decoded and written into the agent's internal OID string buffer.

Detection Guidance

This vulnerability involves an out-of-bounds read in the NetX Duo SNMP addon due to improper OID length validation. Detection requires monitoring for unexpected SNMP packet processing or crashes in the SNMP agent. Check for crashes in SNMP-related processes or logs indicating buffer overflows. Use network monitoring tools to inspect SNMP traffic for malformed packets with unusually large OID lengths.

Impact Analysis

The impact depends on the system configuration. On systems with memory protection, the out-of-bounds read may crash the SNMP agent thread, causing a denial of service. On bare metal embedded systems without memory protection, the read may silently succeed and corrupt the agent's internal state with heap data, potentially leading to undefined behavior or further security issues.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial of service attacks on SNMP agents, which may disrupt critical system monitoring and management functions. The OOB read and heap corruption risks could lead to unauthorized data access or system instability, violating integrity and availability requirements in these regulations.

Mitigation Strategies

Update or patch the NetX Duo SNMP addon to a version that validates OID data length against buffer size. If no patch is available, disable SNMP services or restrict network access to SNMP ports until a fix is applied.

Hi! I’m here to help you understand CVE-2026-102718. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...