DHCP Server Vulnerability in Eclipse ThreadX by NetX Duo

CVE-2026-102720

What is CVE-2026-102720?

A vulnerability in the DHCP client of Eclipse ThreadX allows a malicious DHCP server or user on the LAN to exploit the message parsing process. The issue arises due to improper bounds checking during the option parsing, which can result in a heap buffer overflow. An attacker can craft a DHCP OFFER message with a sequence of skippable options, causing the client to read beyond the allocated buffer. This vulnerability poses a risk of data exposure during the client’s boot process, as the read values could be manipulated to configure network interfaces incorrectly. Mitigation strategies should involve updating the affected software and reviewing network configurations to prevent malicious DHCP responses.

References