Dashboard / CVE-2026-102727

CVE-2026-102727

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 62/100
Published: 2026-09-29 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
S: X
AT: Present
VC: High
VI: Low
VA: None

Description

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without checking that it comes from the client that requested passive mode. An unauthenticated network attacker who connects to the predictable port first receives the file an authenticated user downloads, or supplies the content of the file the user uploads.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Eclipse Foundation Eclipse ThreadX NetX Duo 6.0

References & Advisories (1)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.24%
Raw Score 0.002390
Percentile 15.1%
Date 2026-11-05

EPSS Trend

2026-11-05
0.00239
2026-11-04
0.00197
2026-11-03
0.00197

Intelligence Sources

mitre ref →
nvd ref →

External Links