CVE-2026-106465: CWE-290 Authentication Bypass by Spoofing in Eclipse Foundation NetX Duo

The NetX Secure DTLS server in Eclipse Foundation's NetX Duo sends a HelloVerifyRequest containing a freshly generated cookie to clients. However, when the client returns the cookie, the server fails to validate it properly. The ClientHello parser overwrites the server-issued cookie with the client's cookie bytes, and the server only checks the length of the cookie to determine verification status. An attacker can include any single byte in the ClientHello cookie field to bypass the verification exchange entirely. Consequently, the server does not perform a return-routability check and completes handshakes for forged source addresses, leading to authentication bypass by spoofing.

This vulnerability allows an unauthenticated remote attacker to bypass DTLS handshake verification, enabling the completion of handshakes with forged source IP addresses. This can lead to unauthorized access or communication with the server under false pretenses. The vulnerability has a high severity score (CVSS 8.7) due to its network attack vector, lack of required privileges, and high impact on authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting DTLS server functionality if feasible or applying network-level controls to mitigate spoofing risks. Monitor the vendor's Eclipse Foundation advisories for updates on patches or official fixes.