CVE-2026-106465
Quick assessment
Affected
Eclipse Foundation NetX Duo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NetX Secure DTLS 服务器发送携带新生成 Cookie 的 HelloVerifyRequest，但从不验证客户端返回的 Cookie。ClientHello 解析器会将客户端提供的 Cookie 字节覆盖服务器之前下发的 Cookie 值，随后服务器仅根据 Cookie 的长度来判断客户端是否已验证。因此，任何在首个 ClientHello 中提供任意单个 Cookie 字节的对等方都可以完全绕过验证交换过程，导致服务器缺失返回可达性（return-routability）检查，从而能够基于伪造的源
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1557 · Adversary-in-the-Middle T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Eclipse Foundation | NetX Duo | ≤ 6.5.2.202603 |
affected |
6.5.2.202603a |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106465
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes over the value the server issued, and the server then decides whether the client has been verified from the cookie's length alone. A peer that puts any single cookie byte in its first ClientHello skips the verification exchange entirely, so the server has no return-routability check and completes handshakes for forged source addresses.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Eclipse Foundation | NetX Duo | 0 ~ 6.5.2.202603 | - |
|
II. Public POCs for CVE-2026-106465
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106465
请登录查看更多情报信息。
Other References for CVE-2026-106465 (2)
Same Patch Batch · Eclipse Foundation · 2026-10-14 · 8 CVEs total
| CVE-2026-103415 | 9.3 CRITICAL | TLS 1.3 客户端缓冲区溢出漏洞 |
| CVE-2026-102476 | 9.1 CRITICAL | Eclipse Vert.x SSL缓存绕过漏洞 |
| CVE-2026-106464 | 8.7 HIGH | VxWorks 库TLS空签名解析致越界 |
| CVE-2026-102479 | 8.7 HIGH | Vert.x 5.0-5.2 HTTP请求走私漏洞 |
| CVE-2026-102460 | 8.6 HIGH | CVE-2026-102460 |
| CVE-2026-103414 | 8.4 HIGH | GUIX二进制资源加载器缓冲区溢出漏洞 |
| CVE-2026-102471 | 6.9 MEDIUM | CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages |
IV. Related Vulnerabilities
Same weakness: CWE-290
-
CVE-2026-102764
Improper Origin Validation in Internal Messaging Components -
CVE-2026-102946
joserfc: JWS signature verification bypass via empty signatu -
CVE-2026-110723
api-gateway 1.7.3及以下版本速率限制绕过漏洞 -
CVE-2026-57489
FileRise: AUTH_BYPASS reverse-proxy header trust without sou -
CVE-2026-110768
holaOS through 2026.822.1 Authorization Bypass via Telegram
V. Comments for CVE-2026-106465
No comments yet