Zero Radar
← feed
CriticalVulnerabilityCVE-2026-93475updated 25 Oct 2026, 13:32 UTC

NetX Secure certificate check can be overflowed by an oversized key

A specially crafted security certificate can make the software write data past the memory it should stay within. This can crash the device or let an attacker run their own code on it, and no login is needed.

Official source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker crafts chainIncludes oversized RSA key as intermediate
  2. 2Chain sent to deviceDuring TLS or DTLS handshake
  3. 3Chain verifiedPeer store checked before trusted store
  4. 4Out-of-bounds writePast file-scope static buffer
  5. ResultDevice memory corrupted, possibly code execution

What happened

The X.509 parser in NetX Secure accepts RSA public keys of any size, but signature verification decrypts into fixed buffers sized for the default 4096-bit modulus limit. A larger modulus in a certificate causes an out-of-bounds write past a file-scope static during normal chain verification.

Why it is dangerous: The flaw is reachable before authentication, and the attacker supplies the oversized key as an intermediate certificate in the chain they present. Devices using NetX Secure as TLS/DTLS clients verifying a malicious server, or as servers doing client-certificate authentication, are at risk.

Are you affected?

You are affected if your device or product uses NetX Secure for TLS or DTLS and accepts certificate chains from untrusted peers, including as a client verifying a server or as a server performing client-certificate authentication.

NetX Secure (versions not stated in the source material); default NX_CRYPTO_MAX_RSA_MODULUS_SIZE of 4096 bits.

What to do

  1. Identify whether your products include NetX Secure and check the vendor for a patched version.
  2. Apply the vendor update as soon as it is available.
  3. Until patched, restrict connections to trusted peers and avoid accepting certificate chains from untrusted sources.

Timeline

  1. 20 Oct 2026, 16:17 UTC
    Publicly disclosed
  2. 20 Oct 2026, 16:17 UTC
    Reported by NVD · NVD

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

  • NVD20 Oct 2026, 16:17 UTC

Technical details

ID
CVE-2026-93475
CVSS
9.3 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 16:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

NetX Secure certificate check can be overflowed by an oversized key · Zero Radar