NetX Duo CVE-2025-55085

Exploitation requires the target device to use the NetX Duo HTTP CLIENT module and to initiate an HTTP connection to a server the attacker controls, has compromised, or can MITM - the malformed data arrives in the server's HTTP response headers, so a purely inbound/listening attacker cannot trigger it. Limiting factors: the device must act as an HTTP client reaching an attacker-influenced endpoint; devices that only talk to fixed, authenticated, TLS-pinned servers are far harder to attack. No authentication is required of the attacker (PR:N) and no human interaction is needed (automated client requests), but the dependency on an attacker-positioned server is the key constraint reducing realistic exposure below what the 8.8 base score implies. Affected: Eclipse ThreadX NetX Duo before 6.4.4.

This is a genuine but situationally-gated risk rather than a drop-everything priority. The provided CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, base 8.8) describes a network, low-complexity, unauthenticated flaw, but the description makes clear this is a CLIENT-side vulnerability: the affected NetX Duo HTTP client must parse a crafted response from a server, so an attacker must control, compromise, or MITM the server the embedded device talks to - this precondition is not reflected in the base score and materially raises real-world difficulty. EPSS is 0.61% (47th percentile), which is low-to-moderate and signals no evidence of broad, automated exploitation. Publicly available exploit/POC material exists (the Eclipse GHSA advisory is flagged as exploit), but there is NO CISA KEV listing, so POC availability must not be read as active exploitation - these are distinct signals. There is also an internal impact conflict worth flagging: CWE-125 (out-of-bounds READ) and the 'Information Disclosure' tag imply confidentiality impact, yet the input vector sets VC:N while asserting VI:H/VA:H - integrity-high is hard to justify for a pure read, so the impact profile should be verified against the vendor advisory. Net: moderate priority - patch embedded devices that act as HTTP clients, prioritizing those that connect to untrusted or internet-facing endpoints.

An embedded device running NetX Duo's HTTP client (e.g. for firmware updates or REST API calls) connects to a server the attacker controls or has interposed on via MITM. The malicious server returns an HTTP response with crafted/oversized header fields that bypass the missing bounds check, triggering an out-of-bounds read and undefined behavior that can leak adjacent memory or crash the device. Publicly available exploit code is referenced in the Eclipse security advisory, lowering the barrier to reproduction.