CVE-2026-102718: High severity Microsoft NetX Duo SNMP addon vulnerability
hey,
nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. the OOB bytes are decoded as OID component values and written into the agents internal OID string buffer, corrupting agent state. on systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. on bare metal embedded systems without memory protection the read silently succeeds and corrupts the agents internal state with heap data.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Microsoft NetX Duo SNMP addon are exposed if an attacker can send crafted SNMP packets to the agent. The issue is particularly consequential on bare-metal embedded systems without memory protection, where the out-of-bounds read can silently corrupt internal agent state.
What does an attacker need to do to trigger the flaw?
An attacker needs to send an SNMP packet containing an OID encoded with BER multibyte length encoding whose claimed length exceeds the available packet buffer. This causes the OID parser to read adjacent heap memory and copy decoded values into the agent's internal OID string buffer.
What is the likely operational impact?
On systems with memory protection, the out-of-bounds read may crash the SNMP agent thread and cause denial of service. On systems without memory protection, heap data may be interpreted as OID components and corrupt the agent's internal state without an immediate crash.