NetX Duo CVE-2025-55093

Exploitation requires the target device to be running the NetX Duo IPv4/DHCP client and actively processing DHCP - specifically the handling of UNICAST DHCP messages within _nx_ipv4_packet_receive(). The attacker must be able to deliver a crafted unicast DHCP packet to the client, which in practice means a position as a rogue DHCP server, a DHCP relay, or an on-path/same-L2-segment attacker rather than an arbitrary remote Internet host. Limiting factors: affected versions are NetX Duo before 6.4.4 (6.4.4 fixes it); impact is bounded to corruption of 4 bytes with no confirmed confidentiality or availability effect; and the device must be using the vulnerable DHCP client code path. No authentication (PR:N) and no user interaction are needed once the packet can be delivered.

Multiple signals converge on this being a LOW-to-MODERATE real-world priority rather than an urgent threat, despite a CVSS 4.0 base of 6.9. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity network attack, but the impact metrics are narrow: VC:N, VI:L, VA:N - i.e. only a low integrity effect (corruption of 4 bytes) and explicitly NO confidentiality or availability impact, which is consistent with CWE-126 (buffer over-read). EPSS is 0.31% (22nd percentile), indicating low modeled exploitation probability. There is no CISA KEV listing and no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision was supplied in the input; inferring from the data, technical impact is partial (bounded 4-byte corruption, not demonstrated code execution) and the flaw is unlikely to be trivially automatable because it depends on an in-progress DHCP client transaction. One signal to verify: the vector is AV:N, but DHCP is fundamentally a local-segment protocol, so realistic exploitation likely requires an on-path or rogue DHCP server (adjacent access) rather than arbitrary Internet-based attack - verify network reachability assumptions for your deployment. Net: a genuine bug worth patching on the normal maintenance cycle, not a drop-everything emergency, unless the affected embedded devices expose DHCP client processing to untrusted networks.

An attacker positioned on the local network segment (or operating a rogue/on-path DHCP server) sends a crafted unicast DHCP message to a device running NetX Duo's IPv4/DHCP client stack before 6.4.4. When _nx_ipv4_packet_receive() processes the malformed unicast DHCP packet, an out-of-bounds read occurs that corrupts 4 bytes of memory. No public exploit code has been identified, and the low-complexity network vector is tempered by the requirement that the target actively be performing a DHCP client exchange.