NetX Duo CVE-2025-55083
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted network packet
-
ExploitTrigger faulty bound check in NetX Duo
-
ExecutionRead two bytes past buffer
-
ImpactLeak adjacent memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
|
| Exploitation Conditions | The target must run Eclipse ThreadX NetX Duo at a version before 6.4.4 with the affected (unnamed in the description) network-facing parser reachable, allowing a remote unauthenticated attacker (per PR:N/UI:N) to send a crafted packet that defeats the incorrect bound check. Limiting factors: impact is confined to a two-byte out-of-bounds read (information disclosure / possible crash only, no write or code execution per VC:L/VI:N/VA:N), and real-world reach depends on whether the vulnerable component is enabled and network-exposed in the specific embedded device's firmware build. |
| Impact | Signals are mostly consistent in pointing to a moderate, low-urgency issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) describes a remotely reachable, low-complexity, unauthenticated flaw, but one whose only impact is limited confidentiality (VC:L) with no integrity or availability effect - consistent with CWE-126 (buffer over-read) and the description's 'out by two' out-of-bounds read. The 6.9 score is therefore driven by remote reachability rather than impact. EPSS is low at 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit is referenced, so exploitation pressure is currently minimal and the signals do not conflict. The practical risk is bounded: a two-byte over-read in a network stack typically yields at most a small adjacent-memory disclosure (potential info leak or crash in edge cases), not code execution. One caveat to verify: the description does not name the specific protocol/parser containing the faulty bound check, so the true remote reachability (AV:N) depends on which NetX Duo component is exposed in a given device's configuration - confirm against the GHSA advisory. |
| Exploit ScenarioDerived | A remote attacker on the network sends a crafted packet to an embedded device running NetX Duo before 6.4.4, triggering the incorrect bound check and causing the stack to read two bytes beyond the intended buffer. This could disclose a small amount of adjacent memory or cause abnormal parsing behavior; given AV:N/AC:L/PR:N, no authentication or user interaction is required, though no public exploit code has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Two-byte out-of-bounds read in Eclipse ThreadX NetX Duo before 6.4.4 allows a remote unauthenticated attacker to send a crafted packet to the affected network-facing parser and read limited adjacent memory or trigger a crash. The exposed impact is confidentiality-only under the independent CVSS:3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); NVD lists a CVSS 4.0 score of 6.9. EPSS is 0.25% (15th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis, so remediation should focus on upgrading to 6.4.4 or later.
RemediationAI
Vendor-released patch: NetX Duo 6.4.4. Upgrade embedded ThreadX NetX Duo deployments to 6.4.4 or later and rebuild firmware that bundles the stack, following the advisory at https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9hw5-4xcv-jprm. If immediate upgrade is not possible, disable the affected network-facing parser or service if it is not required; this may break intended network functionality and must be tested against device requirements. Alternatively, restrict network access to the device's NetX Duo-exposed interfaces with firewall or ACL rules and segment affected devices from untrusted networks, accepting that this reduces reachability rather than fixing the underlying out-of-bounds read.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NetX Duo is Eclipse Foundation ThreadX's embedded TCP/IP networking stack, commonly used in RTOS-based devices. The flaw is CWE-126 (buffer over-read) caused by an incorrect bound check in a network-reachable component, allowing a crafted packet to drive a two-byte read past the intended buffer boundary. The CPE cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:* records the Eclipse ThreadX NetX Duo product, while the advisory limits affected releases to those before 6.4.4; the specific parser is not named in the available description. Exploitation requires the vulnerable component to be enabled and reachable over the network in a device's firmware build.
Know when Threadx Netx Duo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated packet triggers the flaw (AV:N/AC:L/PR:N/UI:N); a two-byte over-read yields only limited disclosure, so C:L and I:N/A:N.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
DescriptionCVE.org
In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check resulting it out by two out of bound read.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Threadx Netx Duo
View allOut-of-bounds reads in the Eclipse ThreadX NetX Duo HTTP client module (all versions before 6.4.4) let a malicious, comp
In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could caus
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A special
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of se
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of se
An out-of-bounds read (CWE-125) in Eclipse ThreadX NetX Duo before 6.4.4 allows remote, unauthenticated attackers to rea
An out-of-bounds read in Eclipse ThreadX NetX Duo (all versions before 6.4.4) is triggered in the _nx_ip_packet_receive(
An out-of-bounds read in Eclipse NetX Duo's IPv4 receive path (_nx_ipv4_packet_receive()) can be triggered by delivering
Out-of-bounds read in Eclipse ThreadX NetX Duo before 6.4.4 allows unauthenticated remote attackers to trigger a limited
An out-of-bounds read in Eclipse NetX Duo before 6.4.4 allows remote, unauthenticated attackers to disclose small amount
An out-of-bounds memory read exists in Eclipse ThreadX NetX Duo's secure TLS module (all versions before 6.4.4) due to a
Out-of-bounds read in Eclipse ThreadX NetX Duo (all versions before 6.4.4) lets an attacker who can deliver DHCP traffic
Exploit-DB