The vulnerability in NetX Secure TLS arises from the function `_nx_secure_verify_mac` accepting an empty application-data record whose length equals the negotiated MAC size as valid without generating or comparing the MAC. This means the integrity check is improperly validated, allowing such records to bypass MAC verification. Since empty TLS application-data records are valid and commonly used in TLS 1.0 implementations for BEAST attack mitigation, this behavior can lead to acceptance of unauthenticated data. The affected product versions are from 6.2.0 up to and including 6.5.1.202602. The CVSS 4.0 base score is 6.3, indicating medium severity, with network attack vector, high attack complexity, and no privileges or user interaction required.

The improper validation of the MAC in empty TLS application-data records could allow an attacker to bypass integrity verification for such records. This may lead to acceptance of unauthenticated data within a TLS session, potentially undermining the security guarantees of TLS communications. However, the vulnerability requires network access and has high attack complexity, limiting exploitability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the Eclipse Foundation's advisories for updates. Until a fix is available, consider mitigating risk by restricting use of affected versions or applying compensating controls if feasible.