Eclipse NetX Duo CVE-2025-55087
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SNMP agent over network
-
ExploitSend crafted SNMPv3 security parameters
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactLeak adjacent memory or crash service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target device must run Eclipse ThreadX NetX Duo with the SNMP addon (version before 6.4.4) and have the SNMPv3 agent enabled and reachable on the network. Exploitation requires sending specially crafted SNMPv3 security parameters; the CVSS 4.0 AT:P (attack-requirements present) metric indicates the over-read depends on specific input and memory-layout conditions rather than succeeding on every request. Limiting factors: devices not exposing SNMP, or not using SNMPv3, or already updated to 6.4.4 are not affected; no authentication is required per the vendor vector (PR:N), but the SNMP service must be deployed and accessible. |
| Impact | This is a medium-severity (CVSS 4.0 base 6.3) out-of-bounds read (CWE-125) in the SNMP addon of Eclipse ThreadX NetX Duo. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates a network-reachable, unauthenticated flaw, but the AT:P metric signals that specific attack requirements must be met (crafted SNMPv3 security parameters and a memory state that permits the over-read), which raises real-world complexity above a trivial packet send. Impact is uniformly low (VC:L/VI:L/VA:L) - consistent with an information leak and possible crash rather than code execution. EPSS is low at 0.46% (38th percentile), there is no CISA KEV listing, and no public exploit is referenced, so the signals are mutually consistent in pointing to a non-urgent, low-likelihood issue rather than a high-priority target. One point to verify: the vendor assigned VI:L (some integrity impact) to what the CWE and description describe as a pure out-of-bounds READ, where integrity impact is typically not expected - treat the integrity component as unconfirmed. Overall this is a genuine but lower-tier vulnerability best handled through routine patching to 6.4.4, not emergency response. |
| Exploit ScenarioDerived | An attacker with network access to a device running the NetX Duo SNMP agent sends a crafted SNMPv3 packet whose security parameters are malformed, causing the agent to read beyond the bounds of a buffer. This can leak adjacent memory contents back to the attacker or crash the SNMP service. No public exploit code is identified at time of analysis, and the AT:P requirement means the over-read depends on specific input and memory conditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Crafted SNMPv3 security parameters can drive the SNMP addon of Eclipse ThreadX NetX Duo (versions before 6.4.4) into an out-of-bounds read (CWE-125), allowing remote, unauthenticated attackers who can reach an exposed SNMPv3 agent to read past the bounds of an internal buffer - resulting in limited memory disclosure and possible denial of service through a device crash or reset. The vendor's CVSS 4.0 vector (6.3) and our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) both treat this as a medium-severity, high-complexity issue: the AT:P attack-requirements metric means the over-read depends on specific input values and memory layout rather than succeeding on every request, and exploitation is local to the device only (SC:N/SI:N/SA:N). No public exploit code was identified at time of analysis and CISA KEV does not list this CVE; EPSS is low at 0.46% (38th percentile), consistent with a targeted embedded/OT scenario rather than broad mass exploitation.
RemediationAI
Vendor-released patch: upgrade the NetX Duo SNMP addon to version 6.4.4 or later, as directed by the Eclipse ThreadX advisory GHSA-v474-mv4g-v8cx (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-v474-mv4g-v8cx); because the stack is normally statically linked into firmware, this means rebuilding and reflashing device images with the updated addon and tracking the fix through your OEM or SoC vendor rather than a user-installable update. Where immediate firmware update is not feasible, the most effective compensating control is to disable the SNMP addon entirely if it is not required - this removes the vulnerable code path at zero functional cost for devices that are not managed over SNMP. If SNMP must remain available, restrict network exposure of the agent with host firewalls or ACLs to the specific management subnets and hosts that need it, and place management traffic on an isolated VLAN; this reduces the remote attack surface but does not eliminate the defect for an attacker already on the management segment. As a further interim measure, deploying the agent as SNMPv1/v2c-only avoids the vulnerable SNMPv3 security-parameter parsing path, but this has a real security trade-off (weaker, cleartext-community authentication) and is only advisable on tightly segmented management networks; disabling SNMPv3 alone is not a documented vendor workaround and should be treated as a stopgap rather than a fix. No vendor-released patch alternative for versions below 6.4.4 was identified in the provided references.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Eclipse ThreadX NetX Duo is a real-time, small-footprint TCP/IP networking stack used in embedded, IoT and industrial devices, and the SNMP addon layers an SNMP agent on top of it. The flaw resides in the parsing of SNMPv3 security parameters - the User-based Security Model (USM) fields such as msgAuthoritativeEngineID, msgAuthenticationParameters and the associated length values carried in the message header. When these lengths and structures are not strictly validated against the actual received message size, the agent can compute a pointer or index that extends beyond the packet buffer, producing an out-of-bounds read (CWE-125) rather than a write. Classic impacts for this defect class are disclosure of adjacent heap or stack memory (which may expose credentials, keys or other device state) and unpredictable agent behaviour such as a fault, watchdog reset or crash when the read crosses an unmapped page, which is why the assessed vector includes a low availability impact and a low confidentiality impact but no integrity impact. The affected component is version-gated: the SNMP addon must be present and the SNMPv3 agent enabled and network-reachable; SNMPv1/v2c-only deployments and builds without the addon do not exercise the vulnerable code path. The CPE record cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:* designates Eclipse ThreadX NetX Duo as the affected product family, with the SNMP addon before 6.4.4 as the specific defective component per the reporter (emo@eclipse.org) and the GitHub Security Advisory.
Know when Threadx Netx Duo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable unauthenticated SNMP agent (AV:N/PR:N); AC:H reflects the crafted-parameter and memory-state requirements; out-of-bounds read yields C:L and possible crash A:L, with no integrity impact.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
DescriptionCVE.org
In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by a crafted SNMPv3 security parameters.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Threadx Netx Duo
View allOut-of-bounds reads in the Eclipse ThreadX NetX Duo HTTP client module (all versions before 6.4.4) let a malicious, comp
In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could caus
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A special
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of se
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of se
An out-of-bounds read (CWE-125) in Eclipse ThreadX NetX Duo before 6.4.4 allows remote, unauthenticated attackers to rea
An out-of-bounds read in Eclipse ThreadX NetX Duo (all versions before 6.4.4) is triggered in the _nx_ip_packet_receive(
An out-of-bounds read in Eclipse NetX Duo's IPv4 receive path (_nx_ipv4_packet_receive()) can be triggered by delivering
Out-of-bounds read in Eclipse ThreadX NetX Duo before 6.4.4 allows unauthenticated remote attackers to trigger a limited
An out-of-bounds read in Eclipse NetX Duo before 6.4.4 allows remote, unauthenticated attackers to disclose small amount
An out-of-bounds memory read exists in Eclipse ThreadX NetX Duo's secure TLS module (all versions before 6.4.4) due to a
Out-of-bounds read in Eclipse ThreadX NetX Duo (all versions before 6.4.4) lets an attacker who can deliver DHCP traffic
Exploit-DB