NetX Duo CVE-2025-55094

Exploitation requires the target device to run NetX Duo prior to 6.4.4 with IPv6/ICMPv6 processing enabled (the flaw is specifically in ICMPv6 option validation within _nx_icmpv6_validate_options), and the attacker must be able to deliver an ICMPv6 packet to the device - i.e., on the same IPv6 link or otherwise routable to it. No authentication and no user interaction are needed (PR:N/UI:N). Limiting factors: devices with IPv6 disabled or without reachable ICMPv6 handling are not exposed, and the scored impact is confined to a memory read (confidentiality-low), not code execution or data modification.

This is a medium-severity out-of-bounds read (CWE-125) in the ICMPv6 option validation path of the Eclipse ThreadX NetX Duo TCP/IP stack. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated trigger requiring no user interaction, which is a genuinely favorable profile for an attacker - but the impact metrics constrain the real risk sharply: only VC:L (low confidentiality) with VI:N and VA:N, meaning no integrity or availability impact is scored and the issue is an information-disclosure/memory-read primitive rather than code execution. EPSS is low at 0.41% (33rd percentile), there is no CISA KEV listing, and no public exploit code was identified, so all exploitation signals align toward a non-urgent, not-yet-weaponized issue. The signals are internally consistent (no conflict between CVSS network vector and the description, which also describes packet-based ICMPv6 handling). The one caveat is that an OOB read in a packet parser can in practice also cause a crash/denial of service on some targets even though the vendor scored VA:N - defenders of memory-constrained embedded targets should not assume availability is wholly unaffected. Net: a real but moderate-priority patch item, not an emergency.

An attacker with network reachability to an embedded device running NetX Duo (<6.4.4) sends a crafted ICMPv6 packet containing malformed options; _nx_icmpv6_validate_options() reads past the bounds of the option buffer, potentially leaking adjacent memory contents or destabilizing the stack. No authentication or user interaction is required. No public proof-of-concept exploit was identified at time of analysis.