Eclipse ThreadX NetX Duo DTLS server session exhaustion denies service
A networking part inside devices can be attacked, blocking normal connections.
Summary
The NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims stalled ones, so an unauthenticated remote attacker can exhaust the pool with spoofed datagrams. Versions 6.0 through 6.5.2.202603a are affected.
Affected when
- NetX Duo 6.0 through 6.5.2.202603a in use
What to do
No fixed version is named in the sources. Check that the product runs a version newer than 6.5.2.202603a, and read the Eclipse Foundation advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen