CVE-2026-102727

medium

Description

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without checking that it comes from the client that requested passive mode. An unauthenticated network attacker who connects to the predictable port first receives the file an authenticated user downloads, or supplies the content of the file the user uploads.

References

https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-r2qx-83vg-xqx4

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-89199

Details

Source: Mitre, NVD

Published: 2026-09-29

Updated: 2026-11-04

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 6

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00197