NetX Duo CVE-2025-55082

The affected device must run NetX Duo's secure TLS module acting as a TLS server that processes incoming ClientHello messages and reaches the PSK (pre-shared key) length-handling path in _nx_secure_tls_process_clienthello(), on a version before 6.4.4. The attacker only needs network reachability to that TLS endpoint - no authentication (PR:N) and no user interaction (UI:N) are required. Limiting factors: devices not exposing a NetX Duo TLS server, or builds/handshake flows that never process the PSK length field, are not reachable; and because this is an out-of-bounds read, realistic impact is limited to disclosure of a small amount of adjacent memory or a possible crash - not memory corruption or code execution.

Signals are consistent and point to a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated trigger, but impact is deliberately scoped low: only VC:L (limited confidentiality) with VI:N and VA:N, consistent with an out-of-bounds READ (CWE-125) rather than a write or code-execution flaw. EPSS is low (0.25%, 15th percentile), there is no CISA KEV listing, and no public exploit has been identified - so despite the network vector there is no evidence of widespread or opportunistic exploitation. No SSVC decision data was provided in the input. The one tension worth flagging: the Tags label this a 'Buffer Overflow,' but the CWE (CWE-125) and description describe an out-of-bounds read triggered by missing PSK-length validation - defenders should treat this as an information-disclosure/read-primitive issue, not a memory-corruption/RCE overflow. Net: a real but modest-severity bug (vendor score 6.9), appropriate for routine firmware patching rather than emergency response.

An attacker with network reach to an embedded device running NetX Duo's secure TLS as a server sends a crafted TLS ClientHello whose pre-shared-key (PSK) length field is malformed. Because _nx_secure_tls_process_clienthello() does not validate the PSK length from the user-supplied message, the parser reads past the bounds of the input buffer, potentially leaking adjacent memory contents (or crashing the stack). No authentication or user interaction is required, but no public exploit code is known at time of analysis.