CVE-2026-102761

Executive Summary

CVE-2026-102761 is an out-of-bounds write (CWE-787) in the WebSocket client of Eclipse NetX Duo, a widely embedded TCP/IP and application-protocol stack used in IoT and real-time operating system environments. The flaw causes the client's unmasking XOR loop to advance past the end of the current network packet and into adjacent memory whenever a masked server frame is delivered split across chained packets — a common condition in the stack's standard contiguous packet-pool layout. Because the 4-byte WebSocket masking key directly determines the bytes written, a malicious or compromised WebSocket server can choose the corrupted values, giving it controlled memory-write primitive over the client device.

Technical Analysis

NetX Duo's WebSocket client processes incoming masked server frames by iterating over payload bytes and XORing each byte with a byte of the 4-byte WebSocket masking key. The NVD description states that the implementation "resets the unmasking cursor to the first NX_PACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet."

Two distinct defects combine here:

1. Cursor reset defect. When the client walks a chain of NX_PACKET structures that together hold one logical frame, the cursor that tracks the unmasking position is reinitialized to the head (first) packet as the loop migrates to the next packet in the chain, instead of continuing from the current packet's payload offset. The loop bound, however, is recomputed for the current (advanced) packet.

2. Mismatched bounds. Because the start pointer refers to the first packet while the upper bound refers to a later packet, the XOR loop runs over memory that does not belong to the intended payload window. With the standard contiguous packet-pool layout, the run begins in the first packet's unused payload area, then continues through the boundary between packets and into the next structure's NX_PACKET control block — the linked-list/metadata region that manages the packets themselves.

The masking key is the sole determinant of the values written during XOR, so the corrupted bytes are not random: an attacker who controls the WebSocket server (or who can intercept and re-frame traffic without breaking the masking requirement) chooses the four-byte masking key and therefore selects which bytes are deposited into the adjacent NX_PACKET control block. This elevates an otherwise incidental overrun into an attacker-controlled out-of-bounds write.

The precise address and content of the corruption depend on packet-pool geometry and frame layout on the target. Nevertheless, corruption of an NX_PACKET control block is a high-severity outcome: these blocks hold list pointers and status/metadata fields that are consumed by the stack on subsequent packet operations. Corrupting them can lead to improper pointer traversal, denial of service, and — with careful masking-key selection — a foothold for further memory corruption.

The NVD entry does not enumerate specific NetX Duo function names, call graphs, or the WebSocket API surface beyond the NX_PACKET type. No patch, workaround, or affected-version list has been published, and no public PoC or Nuclei template exists.

Exploitation Scenarios

No public exploit code is available for CVE-2026-102761. The following attack chain is inferred strictly from the vulnerability class (out-of-bounds write via a chained-packet cursor mismatch) and the limited mechanics disclosed in the NVD description.

1. Reconnaissance and target identification. An adversary enumerates devices running NetX Duo that expose or initiate WebSocket client sessions — common in IoT gateways, industrial controllers, and embedded telemetry endpoints that connect outbound to cloud or on-premise WebSocket servers. Because the flaw lives in the client path, targets are systems whose NetX Duo stack acts as a WebSocket client: the attacker must be able to act as the server (or be positioned in the path) for that session. NetX Duo's WebSocket client is reached whenever an application on the device opens a client connection to a remote endpoint, so any device configured to consume server-pushed data over WebSocket is in scope. No product-specific Shodan fingerprint is documented, so identification relies on generic embedded/HTTP artifacts rather than a distinctive banner.

2. Triggering the flaw. The attacker operates as, or compromises, the WebSocket server and sends a valid masked frame whose payload is deliberately split across two chained NX_PACKET structures in the client's contiguous packet pool. Masked server-to-client frames are the mechanism the WebSocket specification requires for this direction; the NVD description explicitly ties the corruption to the masked-frame path and the four-byte masking key. When the client advances to the second packet of the chain, the cursor resets to the first packet while the loop bound remains with the current packet, so the XOR loop traverses the first packet's unused payload area and then runs into the second packet's NX_PACKET control block.

3. Controlling the written bytes. The four-byte masking key controls the bytes written by the XOR operation. By selecting the masking key, the attacker chooses the values deposited into the overrun region — making this an attacker-chosen rather than incidental corruption. Whether full control of a given metadata field is achievable depends on how the key bytes align with the corrupted region on the target; the primitive itself is an attacker-influenced out-of-bounds write, not a guarantee of arbitrary write semantics.

4. Post-exploitation impact. Corruption of an NX_PACKET control block threatens the integrity of the packet-management structures used by the stack. Realistic outcomes, consistent with the described mechanism, are: immediate denial of service (crash or hang) when the corrupted control block is next dereferenced; destabilization of the network stack's packet handling; and — if the attacker can steer the corruption to a strategically useful field through masking-key selection — a foothold for more advanced exploitation. The NVD description does not demonstrate code execution, so that outcome should be treated as a possible but unproven escalation, not a certainty.

Impact Assessment

No CVSS score or vector has been assigned by NVD for this CVE, and FIRST.org has not published an EPSS score. Any quantitative risk indication below is the analyst's own worst-case modeling and is explicitly not a vendor or NVD assessment.

• Confidentiality (C): Low-to-None on the basis of the described primitive alone; the disclosed flaw writes to memory rather than directly reading it.
• Integrity (I): High — an attacker-chosen out-of-bounds write into NX_PACKET control blocks directly compromises the integrity of the client's network stack state.
• Availability (A): High — corrupting packet control structures can crash or hang the vulnerable client, a realistic and low-effort denial-of-service outcome.
• Attack vector / complexity: Network-based; lower complexity once an adversary can act as or interpose on the WebSocket server. No authentication is inherently required to send a frame, but the attacker must influence the server-side or on-path traffic to the client.
• Scope: Unchanged at the component level — the flaw is contained within the WebSocket client and its packet pool — though the consequences of packet-block corruption can ripple across stack operations.

Blast radius. Impact is concentrated on embedded and IoT devices running NetX Duo's WebSocket client. These frequently sit in gateways, industrial controllers, medical/telemetry endpoints, and other contexts where a crash or memory corruption is operationally disruptive. Because the vulnerable code is the client, exposure is limited to devices that initiate WebSocket client sessions; purely server-only deployments and builds that exclude the WebSocket client are not affected. No CISA KEV listing exists, no known threat actor campaign has been attributed, and no exploit-in-the-wild evidence is available.

Detection Guidance

NetX Duo is a C/RTOS network stack that runs on embedded devices; host-endpoint tools (Sigma, EQL, Wazuh) generally lack visibility into its internal memory state. The rules below therefore target network framing behavior and host/audit correlates that could accompany exploitation attempts, and they are best-effort detections for this CVE rather than precise signatures.

Sigma Rule

title: Possible NetX Duo WebSocket Unmasking Out-of-Bounds Write Attempt
id: netxduo-websocket-cve-2026-102761
status: experimental
description: >
  Detects anomalous WebSocket server-to-client masked frames that split payloads
  across packet boundaries, which may trigger the NetX Duo WebSocket client
  out-of-bounds write described in CVE-2026-102761. Host logging may only surface
  the downstream symptom (stack crash/restart) rather than the memory corruption.
author: valtersit.com
date: 2026-01-01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102761
logsource:
  category: network_connection
  product: ids
detection:
  selection_event:
    event_type|contains:
      - 'websocket'
      - 'netx'
  selection_symptom:
    message|contains|all:
      - 'NX_PACKET'
    message|contains:
      - 'corrupt'
      - 'overflow'
      - 'out-of-bounds'
  condition: selection_symptom
falsepositives:
  - Debug/verbose stack logging on development devices
  - Legitimate large fragmented WebSocket frames from benign servers
level: medium
tags:
  - attack.t1190
  - cve.2026.102761

YARA Rule

rule CVE_2026_102761_NetXDuo_WebSocket_OOB
{
    meta:
        description = "Heuristic detection for NetX Duo WebSocket client out-of-bounds write artifacts (CVE-2026-102761); matches stack strings and chained-packet handling markers, not the corruption itself."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102761"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "NX_PACKET" ascii
        $s2 = "NetX Duo" ascii nocase
        $s3 = "WebSocket" ascii nocase
        $s4 = "nx_websocket" ascii nocase
        $mask = { ?? ?? ?? ?? }   // 4-byte masking key placeholder region

    condition:
        uint32be(0) != 0x7f454c46 and
        ( $s1 and ( $s3 or $s4 ) and $s2 )
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-102761 Possible NetX Duo WebSocket Unmasking OOB Write Attempt"; flow:established,to_client; content:"GET /"; http_header; content:"Upgrade: websocket"; http_header; content:"Sec-WebSocket-Key"; http_header; classtype:attempted-user; reference:cve,CVE-2026-102761; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102761; sid:2026102761; rev:1;)

Note: Suricata cannot inspect device-internal packet-pool memory. The rule above flags WebSocket client handshakes/sessions to external endpoints as a coarse correlation signal; it will not reliably distinguish a malicious split-frame from a benign one.

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [network where network.direction == "outbound" and
     network.protocol == "http" and
     http.request.headers contains "Upgrade: websocket"]
  [process where process.name : ("*netx*", "*websocket*")]

EQL is intended for host telemetry (for example, an embedded Linux host exporting stack logs). On bare-metal RTOS deployments without endpoint telemetry, this rule will produce no data and should be treated as aspirational.

Splunk SPL Query

index=network sourcetype=firewall OR sourcetype=proxy
| search websocket OR "Sec-WebSocket-Key" OR "Upgrade: websocket"
| rex field=_raw "(?i)(?<ws_key>Sec-WebSocket-Key:\s*(?<k>[A-Za-z0-9+/=]+))"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port k
| where count >= 1
| sort - last_seen

Wazuh OSSEC Rule

<group name="netxduo,websocket,cve-2026-102761,">
  <rule id="1027610" level="5">
    <decoded_as>syslog</decoded_as>
    <match>NX_PACKET</match>
    <description>CVE-2026-102761: NetX Duo reported NX_PACKET corruption or stack anomaly (possible WebSocket unmasking out-of-bounds write)</description>
    <group>cve_2026_102761,</group>
  </rule>

  <rule id="1027611" level="8">
    <decoded_as>syslog</decoded_as>
    <match>NX_PACKET.*(corrupt|overflow|out-of-bounds|fault)</match>
    <description>CVE-2026-102761: NetX Duo packet control block corruption or fault reported — investigate WebSocket client sessions</description>
    <group>cve_2026_102761,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, and no vendor advisory, affected-version list, or workaround has been published.

1. Immediate mitigations (no vendor fix available):

• Treat all current NetX Duo WebSocket client deployments as affected until the vendor ships a fix.
• Restrict which servers the device is permitted to open WebSocket client sessions to, and constrain those endpoints to trusted, mutually authenticated peers where the product architecture allows it.
• Where feasible, block or disable WebSocket client functionality that is not strictly required by the product's function — reducing the exposed attack surface to zero if the client can be compiled out.
• Isolate embedded devices on segmented network zones and restrict inbound/outbound traffic so that only expected WebSocket servers can interact with the client.
• Enable and monitor device crash/restart logging and stack-level diagnostics that would surface NX_PACKET corruption or unexpected resets.

2. Patch / upgrade steps:

• Monitor the Eclipse NetX Duo project and Microsoft Azure RTOS/NetX Duo distribution channels for a fixed release that corrects the chained-packet unmasking cursor handling.
• Because no fixed version is identified, do not assume any current release is patched; validate the specific release against an official vendor advisory before treating it as remediated.
• When a fix is published, test in a representative staging rig before fleet-wide rollout, and confirm the corrected behavior against split-frame WebSocket payloads.

3. Long-term hardening:

• Adopt memory-safe and bounds-checked parsing patterns for protocol framers, particularly where multiple buffers/packets are chained; ensure a cursor and its upper bound always refer to the same buffer.
• Add regression tests for fragmented WebSocket frames split across chained packets and across packet-pool boundaries, including masked frames that straddle packet limits.
• Implement firmware/dependency inventory and SBOM tracking so that NetX Duo versions in the field can be mapped to future advisories quickly.
• Enable hardware/software memory protections (MPU/MMU isolation, stack canaries, where supported) on embedded platforms to contain consequences of future memory-safety defects.

References

1. NVD — CVE-2026-102761: https://nvd.nist.gov/vuln/detail/CVE-2026-102761
2. Eclipse NetX Duo project (vendor) — monitor for advisory/patched release.
3. CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
4. MITRE ATT&CK — T1190, Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. FIRST.org EPSS — no score currently assigned for CVE-2026-102761 at time of writing.

No threat actor campaign, exploit-in-the-wild evidence, public PoC, or CISA KEV listing is associated with this CVE as of this report.