# CVE-2026-102718: NetX Duo SNMP addon buffer over-read in OID parsing

Source: https://junglewise.ai/threats/cve-2026-102718-hey-nx-snmp-utility-object-id-get-in-the-netx-duo-snmp-addon  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102718 · Severity: info · Published 2026-09-29

NetX Duo's SNMP addon, used in embedded systems to handle network monitoring requests, fails to validate the length of object identifiers in SNMP packets. An attacker can send a specially crafted SNMP packet that causes the parser to read past the packet buffer boundary, corrupting internal agent state or crashing the SNMP service. On systems without memory protection, the corrupted state could lead to unpredictable behavior or further compromise.

Technologies: [Eclipse ThreadX NetX Duo](https://junglewise.ai/threats/technologies/eclipse-threadx-netx-duo). Vendors: [Eclipse ThreadX](https://junglewise.ai/threats/vendors/eclipse-threadx).

## Quick answers

**Is CVE-2026-102718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102718 being exploited in the wild.

**How severe is CVE-2026-102718?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Eclipse ThreadX NetX Duo <UNKNOWN>.

**Is there a fix for CVE-2026-102718?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102718 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-102718?** Check whether you run Eclipse ThreadX NetX Duo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The _nx_snmp_utility_object_id_get function does not validate claimed OID data length against actual buffer size when BER multibyte length encoding is used. A remote attacker can send a crafted SNMP packet with an oversized multibyte OID length, causing an out-of-bounds read that decodes heap memory as OID values and writes them into the agent's internal OID buffer. On systems with memory protection this causes DoS via crash; on bare metal systems the corrupted state persists silently.

## Affected products

- Eclipse ThreadX NetX Duo <UNKNOWN>

## Timeline

- 2026-09-29: disclosed

## References

- [https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-7qmm-29vg-7hf8](https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-7qmm-29vg-7hf8)

## Related threats

- [Eclipse ThreadX NetX Duo NULL pointer dereference in ICMPv6 path MTU discovery](https://junglewise.ai/threats/cve-2026-114408-in-eclipse-threadx-netx-duo-versions-6-4-5-202504-through-6-5-2)
- [Eclipse ThreadX NetX Duo Web HTTP server use-after-free](https://junglewise.ai/threats/cve-2026-94018-the-web-add-on-s-http-server-dereferences-and-releases-an)
- [Eclipse ThreadX NetX Duo HTTP server request framing confusion](https://junglewise.ai/threats/cve-2026-93003-the-web-add-on-s-http-server-searches-the-entire-request-packet)
- [NetX Secure TLS 1.3 out-of-bounds read in Certificate parser](https://junglewise.ai/threats/cve-2026-92853-the-tls-1-3-certificate-message-parser-in-netx-secure-decrements)
- [NetX Secure DTLS server missing HelloVerifyRequest cookie validation](https://junglewise.ai/threats/cve-2026-106465-the-netx-secure-dtls-server-sends-a-helloverifyrequest-carrying)