TLS Vulnerability in NetX Secure by NetX Duo

CVE-2026-102759

What is CVE-2026-102759?

NetX Secure TLS has a vulnerability where it accepts empty application-data records without verifying their message authentication codes. This flaw occurs in the _nx_secure_verify_mac function, which erroneously considers a decrypted application record—whose length matches the negotiated MAC size—as valid. Consequently, the function advances the receive sequence number without performing necessary MAC checks, potentially allowing for unauthorized data manipulation in TLS communications. This issue is particularly concerning as empty application data records are legally permitted and frequently produced by TLS 1.0 implementations, especially to mitigate the BEAST attack.

References