EUVD-2026-89176
GHSA-fhxv-gc8j-2f6h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated single-packet network trigger against the TFTP server (AV:N/AC:L/PR:N/UI:N); heap memory disclosure gives C:H and thread-suspension DoS gives A:H, with no controllable corruption so I:N.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
2DescriptionCVE.org
The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than
four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not
against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. Two things follow from that one
missing check, both reachable before any authentication because TFTP has none.
The handler passes nx_packet_length - 4 straight to FileX:
/* addons/tftp/nxd_tftp_server.c:1863, 1889 */
status = nx_packet_copy(packet_ptr, &temp_ptr,
server_ptr -> nx_tftp_server_packet_pool_ptr, NX_WAIT_FOREVER);
...
fx_file_write(&(client_request_ptr -> nx_tftp_client_request_file),
packet_ptr -> nx_packet_prepend_ptr + 4,
packet_ptr -> nx_packet_length - 4);
nx_packet_length is the length of a chain, not of one contiguous buffer, so FileX copies past the
end of the first packet:
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1280 at 0x621000001108 thread T5
#0 __interceptor_memcpy
#1 _fx_utility_memory_copy filex/common/src/fx_utility_memory_copy.c:78
0x621000001108 is 0 bytes to the right of 4104-byte region
Those bytes are written into the file the attacker is uploading, and a TFTP read request hands them
back, so this is a memory disclosure with a convenient retrieval channel.
The same datagram also wedges the server. nx_packet_copy at :1863 needs
ceil(nx_packet_length / pool_payload) packets and asks for them with NX_WAIT_FOREVER, so when the
attacker sizes the datagram beyond what the pool holds, the server thread suspends and never
returns. A liveness probe after one such datagram times out with the pool at 0 of 12 packets and
the server thread suspended, and no later client is served.
Reject nx_packet_length > 4 + NX_TFTP_FILE_TRANSFER_MAX in the DATA branch before either call,
and use a bounded wait rather than NX_WAIT_FOREVER for the copy.
AnalysisAI
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an unauthenticated remote attacker sending a single oversized DATA datagram over the network, because the DATA branch enforces only a four-byte minimum (nxd_tftp_server.c:1037) and never validates an upper bound against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. The oversized length is passed as nx_packet_length - 4 into FileX via fx_file_write, and since nx_packet_length measures the whole packet chain rather than the first contiguous buffer, FileX reads past the end of that buffer and the leaked heap contents are written into the file the attacker is uploading, which a subsequent TFTP read request returns to the attacker; the same datagram also wedges the server permanently because nx_packet_copy with NX_WAIT_FOREVER suspends the server thread once the request exceeds the packet pool capacity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target device to be running the NetX Duo TFTP server addon (nxd_tftp_server) and reachable over the network; TFTP itself has no authentication, so no credentials or user interaction are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H, base 8.8) is well-supported by the description: TFTP has no authentication, so the missing upper-bound check on DATA datagram length is reachable by any remote unauthenticated attacker with a single crafted packet and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched version is identified in the available data, so the primary action is to obtain the fixed NetX Duo release from the Eclipse ThreadX advisory GHSA-wr79-332c-ff8f (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-wr79-332c-ff8f) and rebuild/refit the affected firmware; until a vendor binary is available, the upstream fix is a two-line change in the DATA branch of addons/tftp/nxd_tftp_server.c that rejects any datagram where nx_packet_length > 4 + NX_TFTP_FILE_TRANSFER_MAX before either nx_packet_copy or fx_file_write, plus replacing the NX_WAIT_FOREVER wait in nx_packet_copy with a bounded timeout so a single oversized request can no longer suspend the server thread - note that the bounded wait means genuinely large transfers may now fail fast under pool pressure, which is preferable to a permanently wedged server but should be sized against expected legitimate payloads. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all products and services that embed the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) as identified by CVE-2026-102713, disable the TFTP addon or block UDP port 69 from untrusted networks where TFTP is not required, and alert SOC teams to monitor for oversized TFTP DATA datagrams or unresponsive TFTP server threads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACK
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated re
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device,
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, perf
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server r
Eclipse NetX Duo's NetX Secure TLS stack accepts empty application-data records without ever generating or comparing the
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today