The vulnerability identified as CVE-2026-102719 in the Eclipse Foundation netxduo product relates to the use of insufficiently random values (CWE-330) in the DTLS HelloVerifyRequest cookie. This predictability in the cookie generation can undermine the security guarantees of the DTLS protocol by allowing attackers to potentially predict or replay handshake messages. The affected versions include all releases from 0 up to and including 6.5.1. The CVSS 4.0 base score is 6.3, indicating a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited impact on confidentiality and availability.

The impact of this vulnerability is a reduction in the randomness of the DTLS HelloVerifyRequest cookie, which could allow attackers to predict or replay handshake messages. This may lead to weakened protection against certain types of denial-of-service or spoofing attacks during the DTLS handshake. However, the overall impact is limited as indicated by the CVSS vector, with no direct impact on confidentiality or integrity and only limited impact on availability.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates and consider mitigating exposure by restricting network access to DTLS services if feasible.