Eclipse NetX Duo CVE-2025-55090

Requires delivering a specifically malformed Ethernet frame carrying an IPv4 packet of fewer than 4 bytes to a target running Eclipse ThreadX NetX Duo before 6.4.4, so that _nx_ipv4_packet_receive() over-reads the truncated packet buffer. No authentication is required (PR:N). Limiting factors: the 'Ethernet frame' trigger implies the attacker needs link-layer/adjacent network position to inject the frame rather than arbitrary internet routability; impact is confined to a small out-of-bounds read (minor information disclosure, VC:L) with no integrity or availability effect; only devices on vulnerable firmware (< 6.4.4) using the IPv4 receive path are affected.

This is a moderate, not high-priority, issue. The input CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 and describes an unauthenticated, low-complexity, remotely reachable flaw, but the only impact metric set is VC:L (low confidentiality) with VI:N and VA:N - consistent with CWE-125, a bounded out-of-bounds READ that leaks a small amount of adjacent memory rather than enabling code execution or crashes. EPSS is low at 0.37% (29th percentile), there is no CISA KEV listing, and no public exploit is referenced, so there is no evidence of active exploitation - this is no public exploit identified at time of analysis. One signal conflicts with the vector: the description says the trigger is 'an Ethernet frame,' which implies Layer-2/adjacent delivery (AV:A) rather than routable network reach (AV:N); verify reachability with the vendor, because if the parser only processes link-local frames the practical attack surface is narrower than AV:N suggests. Net: a real but low-to-moderate bug - worth patching in affected embedded fleets, not an emergency.

An attacker on the same link (or a path that can deliver raw frames) as a device running NetX Duo < 6.4.4 sends a malformed Ethernet frame whose IPv4 payload is under 4 bytes. The _nx_ipv4_packet_receive() function reads past the end of the short packet buffer, disclosing a small amount of adjacent memory. No public proof-of-concept is referenced, and the leaked data is limited in size.