{"schema":"threatline.record/2","record":{"id":"CVE-2026-102718","aliases":["GHSA-7qmm-29vg-7hf8"],"summary":"hey,\n\n\n\n`_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a r","details":"hey,\n\n\n\n`_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. the OOB bytes are decoded as OID component values and written into the agents internal OID string buffer, corrupting agent state. on systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. on bare metal embedded systems without memory protection the read silently succeeds and corrupts the agents internal state with heap data.","categories":["Unclassified"],"product":"NetX Duo","vendor":"Eclipse Foundation","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102718","source_modified_at":"2026-09-29T18:40:08.114Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"NetX Duo","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"6.5.1.202602","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-7qmm-29vg-7hf8","source_modified_at":"2026-10-13T02:12:07Z","fetched_at":"2026-10-24T05:41:33.294140Z","package":{"ecosystem":"eclipse threadx","name":"NetX Duo"},"range":"<= 6.5.2.202603"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-7qmm-29vg-7hf8","source_modified_at":"2026-10-13T02:12:07Z","fetched_at":"2026-10-24T05:41:33.294140Z","package":{"ecosystem":"eclipse threadx","name":"NetX Duo"},"version":"6.5.2.202603a"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00308,"percentile":0.224,"score_date":"2026-10-23"},"published_at":"2026-09-29T17:44:43.914Z","modified_at":"2026-10-13T02:12:07Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-102718","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-29T18:40:08.114Z"},{"source":"GitHub Advisory Database","url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-7qmm-29vg-7hf8","fetched_at":"2026-10-24T05:41:33.294140Z","source_modified_at":"2026-10-13T02:12:07Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102718","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-7qmm-29vg-7hf8"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-29T18:39:57.003355Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-13T02:12:07Z","content_hash":"ad730b9997650a59fc32cbf76616e0e5046823abca2262cdd3cc9d0f60213c29"}}