CVE-2026-102719 is a vulnerability in Eclipse Threadx Netx Duo
Published on September 29, 2026
NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(), by default the C library rand(), with no key and no binding to the client. An attacker who can predict the generator's output can pass the cookie exchange from a spoofed address and make the server send its handshake flight to a victim, using it as a traffic reflector.
Vulnerability Analysis
CVE-2026-102719 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a PRNG Vulnerability?
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CVE-2026-102719 has been classified to as a PRNG vulnerability or weakness.
Products Associated with CVE-2026-102719
Want to know whenever a new CVE is published for Eclipse Threadx Netx Duo? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse ThreadX NetX Duo:- Version 6.0, <= 6.5.2.202603a is affected.
- Version 6.5.2.202603b is unaffected.