Eclipse ThreadX NetX Duo 6.0-6.5.2.202603 DTLS Cookie Validation Bypass
CVE-2026-106465 Published on October 14, 2026

Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with the one it issued, and treats any non-empty cookie as verified. A remote attacker can make the server send its full handshake flight, several kilobytes, to a forged source address, using it to reflect amplified traffic at a third party.

NVD

Vulnerability Analysis

CVE-2026-106465 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Exploitation:
NONE
Automatable:
YES
Technical Impact:
PARTIAL
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE

Weakness Types

Authentication Bypass by Spoofing

This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.

What is a Network Amplification Vulnerability?

The software does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the software to transmit more traffic than should be allowed for that actor. In the absence of a policy to restrict asymmetric resource consumption, the application or system cannot distinguish between legitimate transmissions and traffic intended to serve as an amplifying attack on target systems. Systems can often be configured to restrict the amount of traffic sent out on behalf of a client, based on the client's origin or access level. This is usually defined in a resource allocation policy. In the absence of a mechanism to keep track of transmissions, the system or application can be easily abused to transmit asymmetrically greater traffic than the request or client should be permitted to.

CVE-2026-106465 has been classified to as a Network Amplification vulnerability or weakness.


Products Associated with CVE-2026-106465

Want to know whenever a new CVE is published for Eclipse Threadx Netx Duo? stack.watch will email you.

Eclipse Threadx Netx Duo

Affected Versions

Eclipse Foundation Eclipse ThreadX NetX Duo: