Key points
- CVE-2026-94018 affects Eclipse ThreadX NetX Duo versions up to 6.5.1.202602.
- The flaw allows unauthenticated remote crashes via a malformed PUT request.
- No fix or update has been confirmed by the vendor at this time.
Eclipse ThreadX NetX Duo systems running version 6.5.1.202602 or earlier are vulnerable to a high-severity crash. The issue resides in the Web add-on's HTTP server component. Attackers do not need credentials to trigger the flaw. A single malformed request can cause the server to fail. This exposes connected devices to denial-of-service conditions.
In plain English
The HTTP server in this software mishandles data when processing specific commands. It attempts to use a memory pointer that has not been properly initialized. This happens when the server detects an underflow in the Content-Length field. The underflow occurs during the processing of a PUT request. The server then tries to release this uninitialized pointer. This action causes the application to terminate unexpectedly.
The background
The National Vulnerability Database lists this issue as CVE-2026-94018. It carries a CVSS score of 8.8, which is rated as high severity. The weaknesses are classified under CWE-457 and CWE-824. The flaw is reachable by any remote client on the network. The client does not need to authenticate to exploit the condition. Only one malformed request is required to trigger the crash.
What changes now
Organizations must identify all instances of ThreadX NetX Duo in their environments. They need to verify the version number against the affected list. Since no patch exists, teams must monitor vendor communications closely. Exposure should be reduced by limiting network access to the HTTP server. Administrators should prepare for a future update by testing procedures now.
Who needs to act first
Teams should prioritize systems that are exposed to untrusted networks or the internet. Check whether the HTTP server is enabled on devices facing external traffic. If possible, restrict access to the service using firewall rules until a fix is available. Back up configurations before making any network changes. Test any temporary restrictions in a non-production environment first. Ensure logging is active to detect potential abuse attempts. Verify that monitoring tools can alert on service restarts or crashes.
Background: Firewall rules
The difference between acl and firewall rules lies in their operational depth and memory usage. Access control lists evaluate packets statically based on source and destination addresses, while firewalls inspect connection states, transport protocols, and application context to make dynamic filtering decisions.
Read the full guide: Difference between acl and firewall rules explained clearly
What to do and how to stay safe: Eclipse
- Audit your inventory for Eclipse ThreadX NetX Duo version 6.5.1.202602 or older.
- Restrict network access to the HTTP server to trusted internal addresses only.
- Monitor server logs for unexpected restarts or failed PUT requests.
- Watch for official vendor announcements regarding a security update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What version of ThreadX NetX Duo is affected?
Versions up to 6.5.1.202602 are affected by CVE-2026-94018.
Can an attacker exploit this without logging in?
Yes, the flaw is reachable by an unauthenticated remote client.
Is there a patch available for this vulnerability?
No fix has been confirmed yet by the vendor.
