CVE-2026-102761

Name of the Vulnerable Software and Affected Versions NetX Duo (affected versions not specified)

Description The WebSocket client incorrectly resets the unmasking cursor to the first NX PACKET when advancing through a chained packet, while the loop's upper bound remains tied to the current packet. In a standard contiguous packet-pool layout, a masked server frame split across two packets causes the XOR loop to write through the first packet's unused payload area and into the second packet's NX PACKET control block. Because the four-byte WebSocket masking key controls the bytes written, this allows for attacker-chosen memory corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.