Eclipse NetXDuo CVE-2025-55086

Exploitation requires that the NetXDuo application has the DHCPv6 client enabled and in use, and that the attacker can deliver a crafted DHCPv6 server reply - i.e., operate as a rogue DHCPv6 server or man-in-the-middle on the same local link, since DHCPv6 is link-local (multicast ff02::1:2). The specific trigger is the unchecked index used when extracting the server DUID from the server's reply packet. Limiting factors: the device must be actively soliciting/processing DHCPv6 replies (CVSS AT:P reflects this state requirement), the attacker needs on-link or on-path positioning rather than arbitrary Internet reachability, and impact is bounded to a memory over-read (crash/fault) with no confidentiality impact per the vendor vector. Devices not using the DHCPv6 client are unaffected.

This is a medium-severity (CVSS 6.3) out-of-bounds read (CWE-125) in the NetXDuo DHCPv6 client, and the signals converge on real-but-moderate risk rather than an urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) rates it unauthenticated with low complexity but notes Attack Requirements Present (AT:P), reflecting that the attacker must act as the DHCPv6 responder to a soliciting client - a meaningful constraint. Impact is capped at low integrity and low availability (VI:L/VA:L) with explicitly no confidentiality impact (VC:N), so the vendor scoped this as a crash/memory-fault condition rather than data exfiltration. The EPSS score is low (0.41%, 34th percentile), there is no CISA KEV listing, and no public exploit code was identified, so exploitation is neither confirmed nor imminent. CONFLICT TO NOTE: the input Tags include 'Information Disclosure' and the CWE is an OOB read, yet the vendor CVSS sets confidentiality to N - treat the information-disclosure framing as unverified against the vendor's own impact scoring. Additionally, the vendor set AV:N, but DHCPv6 is inherently a link-local protocol, so a network-wide (Internet-facing) attack is unlikely without an on-path or on-link position - verify the realistic attack surface against your deployment topology.

An attacker on the same local link (or a rogue/MITM DHCPv6 server) waits for or induces a NetXDuo device to solicit a DHCPv6 lease, then returns a crafted reply whose server DUID field drives an unchecked index, triggering an out-of-bounds memory read. The result is most likely a device crash or fault in the embedded TCP/IP stack. No public exploit code was identified at time of analysis.