# CVE-2026-102717: Eclipse ThreadX NetX Duo MQTT WebSocket setter ABI mismatch

Source: https://junglewise.ai/threats/cve-2026-102717-mqtt-websocket-setter-abi-mismatch-may-disclose-memory-or-cause  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-102717 · Severity: info · Published 2026-09-30

Eclipse ThreadX NetX Duo is a network stack used in embedded systems and IoT devices. A mismatch in the function signature of an MQTT WebSocket setter could allow an attacker to trigger memory disclosure or cause the application to crash, potentially disrupting network-dependent devices or exposing sensitive data.

Technologies: [Eclipse ThreadX NetX Duo](https://junglewise.ai/threats/technologies/eclipse-threadx-netx-duo). Vendors: [Eclipse ThreadX](https://junglewise.ai/threats/vendors/eclipse-threadx).

## Quick answers

**Is CVE-2026-102717 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102717 being exploited in the wild.

**How severe is CVE-2026-102717?** Informational severity, published 30 September 2026.

**Which products and versions are affected?** Eclipse ThreadX NetX Duo.

**Is there a fix for CVE-2026-102717?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-102717?** Check whether you run Eclipse ThreadX NetX Duo. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An ABI (Application Binary Interface) mismatch in the MQTT WebSocket setter function in NetX Duo can be exploited to trigger out-of-bounds memory access. This vulnerability may lead to information disclosure through memory reads or denial of service via crash. The exact attack vector and preconditions require further investigation from official advisories.

## Affected products

- Eclipse ThreadX NetX Duo

## Timeline

- 2026-09-30: disclosed

## References

- [https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-hp64-f44f-wjw6](https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-hp64-f44f-wjw6)

## Related threats

- [Eclipse ThreadX NetX Duo NULL pointer dereference in ICMPv6 path MTU discovery](https://junglewise.ai/threats/cve-2026-114408-in-eclipse-threadx-netx-duo-versions-6-4-5-202504-through-6-5-2)
- [Eclipse ThreadX NetX Duo Web HTTP server use-after-free](https://junglewise.ai/threats/cve-2026-94018-the-web-add-on-s-http-server-dereferences-and-releases-an)
- [Eclipse ThreadX NetX Duo HTTP server request framing confusion](https://junglewise.ai/threats/cve-2026-93003-the-web-add-on-s-http-server-searches-the-entire-request-packet)
- [NetX Secure TLS 1.3 out-of-bounds read in Certificate parser](https://junglewise.ai/threats/cve-2026-92853-the-tls-1-3-certificate-message-parser-in-netx-secure-decrements)
- [NetX Secure DTLS server missing HelloVerifyRequest cookie validation](https://junglewise.ai/threats/cve-2026-106465-the-netx-secure-dtls-server-sends-a-helloverifyrequest-carrying)