Eclipse NetX Duo CVE-2025-55092
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device IP stack over network
-
ExploitSend crafted IPv4 timestamp option
-
ExecutionTrigger out-of-bounds read in option parser
-
ImpactDisclose adjacent memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to be running NetX Duo (the networking module for Eclipse ThreadX) at a version before 6.4.4 with IPv4 enabled and reachable on the network, and requires the device to process an inbound IPv4 packet carrying the timestamp IP option in _nx_ipv4_option_process(). No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: the device must actually parse IPv4 options (not all embedded deployments expose or process option-bearing traffic), and impact is confined to an out-of-bounds read (information disclosure), so there is no code execution or guaranteed availability impact; attacker control over what memory is disclosed is likely limited. |
| Impact | This is a moderate-severity, low-priority issue rather than an urgent one. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity reachability, but the impact is narrow: only confidentiality is affected at Low (VC:L), with no integrity or availability impact, consistent with CWE-125 (out-of-bounds read / information disclosure). The EPSS score of 0.33% (24th percentile) indicates low predicted exploitation likelihood, there is no CISA KEV listing, and no public exploit code was identified in the provided data - all three exploitation signals align and point to low real-world urgency. The signals are internally consistent: a network-reachable but information-disclosure-only bug with low EPSS and no known exploitation is a 'patch in normal cycle' item, not a drop-everything priority. One caveat: the input provides only a CVSS 4.0 vector, so any 3.1-based tooling comparisons must be derived rather than read directly. |
| Exploit ScenarioDerived | A remote attacker sends a crafted IPv4 packet containing a malformed timestamp option to a device running a vulnerable NetX Duo IP stack. The option-processing routine _nx_ipv4_option_process() reads past the bounds of the option buffer, potentially leaking adjacent memory contents or causing unstable behavior. No public exploit code was identified at time of analysis, and the impact is limited to information disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
An out-of-bounds read in Eclipse NetX Duo before 6.4.4 allows remote, unauthenticated attackers to disclose small amounts of adjacent memory when the embedded TCP/IP stack parses an inbound IPv4 packet carrying the IP timestamp option. The flaw lives in _nx_ipv4_option_process() and affects devices running the NetX Duo networking module for Eclipse ThreadX with IPv4 enabled and network-reachable; impact is limited to information disclosure (C:L) with no code execution or denial-of-service effect. Exploitation requires the target to actually parse IPv4 options and the attacker has limited control over which memory is leaked, EPSS is a low 0.33% (24th percentile), and no public exploit has been identified at time of analysis, making this a moderate-severity, low-priority issue rather than an urgent one.
RemediationAI
Upgrade NetX Duo to version 6.4.4 or later; this is the vendor-released patch that corrects the bounds handling in _nx_ipv4_option_process() (see GHSA-vwh7-h99r-fvwq). Because NetX Duo is typically statically linked into firmware, remediation generally means pulling the updated netxduo sources into the device build and reflashing - coordinate with the OEM if the firmware is vendor-supplied rather than self-built, and verify the shipped version string rather than assuming a rebranded image contains the fix. Where immediate upgrade is not feasible, the most effective compensating control is to prevent IPv4 packets with options from reaching the stack: configure upstream routers or firewalls to drop or strip IP options, or, if the platform exposes it, disable IP option processing so option-bearing datagrams are discarded before _nx_ipv4_option_process() runs. The trade-off is that legitimate IPv4 option traffic (timestamp, record-route, router-alert) will break, which is acceptable for most embedded deployments since these options are rarely required in production. Note that this is a low-severity information-disclosure issue with EPSS 0.33% and no known public exploit, so scheduled patch cycles, not emergency out-of-band response, are appropriate.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NetX Duo is the IPv4/IPv6 networking stack bundled with Eclipse ThreadX (formerly Azure RTOS), widely embedded in IoT, industrial, and consumer devices where a full OS networking stack would be impractical. The vulnerable routine, _nx_ipv4_option_process(), walks the variable-length option field of an inbound IPv4 header; when it encounters the timestamp option (IP option type 68, RFC 791), its bounds handling can read past the end of the received packet buffer. This is a classic CWE-125 out-of-bounds read: no memory is written and no pointer is dereferenced for control flow, so the consequence is disclosure of adjacent buffer contents rather than code execution. Because the CVSS 4.0 base vector is AV:N/AC:L/AT:N/PR:N/UI:N with only VC:L (low confidentiality) and no integrity, availability, or subsequent-system impact, the assessment is consistent with our CVSS 3.1 evaluation of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - unauthenticated remote reachability is required, but the practical blast radius is bounded by how much exploitable information the leaked bytes contain and by whether the deployment forwards option-bearing packets to the stack at all.
Know when Threadx Netx Duo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated parsing of inbound IPv4 options gives AV:N/AC:L/PR:N/UI:N; an out-of-bounds read yields C:L with no integrity or availability impact.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
DescriptionCVE.org
In Eclipse Foundation NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_option_process() when processing an IPv4 packet with the timestamp option.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
More in Threadx Netx Duo
View allOut-of-bounds reads in the Eclipse ThreadX NetX Duo HTTP client module (all versions before 6.4.4) let a malicious, comp
In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could caus
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A special
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of se
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of se
An out-of-bounds read (CWE-125) in Eclipse ThreadX NetX Duo before 6.4.4 allows remote, unauthenticated attackers to rea
An out-of-bounds read in Eclipse ThreadX NetX Duo (all versions before 6.4.4) is triggered in the _nx_ip_packet_receive(
An out-of-bounds read in Eclipse NetX Duo's IPv4 receive path (_nx_ipv4_packet_receive()) can be triggered by delivering
Out-of-bounds read in Eclipse ThreadX NetX Duo before 6.4.4 allows unauthenticated remote attackers to trigger a limited
An out-of-bounds memory read exists in Eclipse ThreadX NetX Duo's secure TLS module (all versions before 6.4.4) due to a
Out-of-bounds read in Eclipse ThreadX NetX Duo (all versions before 6.4.4) lets an attacker who can deliver DHCP traffic
Two-byte out-of-bounds read in Eclipse ThreadX NetX Duo before 6.4.4 allows a remote unauthenticated attacker to send a
Exploit-DB