NetX Duo CVE-2025-55081

Requires the target device to be running NetX Duo's secure TLS component in SERVER mode and be network-reachable so it will process attacker-supplied ClientHello messages during the handshake; the flaw is in server-side _nx_secure_tls_process_clienthello(). No authentication is required (PR:N) because the defect is triggered pre-handshake, and no user interaction is needed. Limiting factors: devices that do not expose a NetX Duo TLS server (e.g., TLS-client-only or non-TLS deployments) and devices already updated to 6.4.4 or later are not exploitable; impact is confined to a low-severity out-of-bounds read rather than code execution.

Signals point to a real but moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated trigger with no user interaction, which is why the base score lands at 6.9 (medium). However, impact is deliberately narrow: only VC:L (low confidentiality) with VI:N/VA:N, consistent with an out-of-bounds read (CWE-126) that may expose adjacent memory but does not grant code execution or confirmed denial of service. EPSS is low at 0.37% (29th percentile), there is no CISA KEV listing, and no public exploit code is referenced - all three corroborate a low near-term exploitation likelihood. The one caveat is that the vendor assessed VA:N even though out-of-bounds reads frequently cause crashes/DoS on constrained RTOS targets; defenders should treat availability impact as plausible-but-unconfirmed and verify against their device behavior. Net: patch on a normal cadence, prioritizing internet-facing embedded TLS servers, but this is not a drop-everything issue.

An attacker able to reach an embedded device that uses NetX Duo's secure TLS stack in server mode sends a crafted SSL/TLS ClientHello whose ciphersuite-length and compression-method-length fields fall outside the expected range. Because _nx_secure_tls_process_clienthello() fails to validate these lengths, parsing proceeds past the buffer, producing an out-of-bounds read that may leak adjacent memory contents or destabilize the handshake. No public exploit code has been identified at time of analysis.