Medium severity · published Sep 29, 2026
CVE-2026-102759
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted application record whose length equals the negotiated MAC size is treated as valid and returns success after advancing the receive sequence number. The received MAC is never generated or compared.
Empty TLS application-data records are legal, and are commonly emitted by TLS 1.0 implementations as a BEAST mitigation.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ND
NetX Duo · Eclipse Foundation
6.2.0 through 6.5.1.202602 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102759
github.com
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-m7j3-vh25-xc8p
More from NetX Duo
9.3
CVE-2026-103415
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet
9.3
CVE-2026-102761
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the…
8.8
CVE-2026-102713
The TFTP server accepts a DATA datagram of any size
8.8
CVE-2026-102712
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the…
8.7
CVE-2026-106465
The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns