EUVD-2026-89189
GHSA-h2rg-f2rc-xc9m
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent L2 MSRP protocol (AV:A); AC:H because the attacker must exhaust the attribute table rather than send one packet; unauthenticated (PR:N); availability-only crash (A:H).
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
2DescriptionCVE.org
NULL Pointer Dereference on MSRP Attribute Table Exhaustion
AnalysisAI
Attribute table exhaustion in Eclipse ThreadX NetX Duo's MSRP (Multiple Stream Reservation Protocol) handling triggers a NULL pointer dereference that halts the affected device, producing an availability-only denial of service. Only deployments where MSRP/AVB-TSN support is compiled in and actively running are exposed, and the attacker must be on the same Layer-2 bridged segment because MSRP frames are not routed outside the local bridge domain. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target NetX Duo device to have MSRP (Multiple Stream Reservation Protocol, part of IEEE 802.1 AVB/TSN audio-video bridging) enabled and active - this is a non-default, use-case-specific feature, not part of the base TCP/IP stack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is an availability-only denial-of-service issue (CWE-476 NULL pointer dereference) in Eclipse ThreadX NetX Duo's MSRP (Multiple Stream Reservation Protocol / IEEE 802.1Qat AVB-TSN) handling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis: the only supplied reference is the GitHub security advisory GHSA-jq4g-x753-4cc6 (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-jq4g-x753-4cc6), which should be consulted for the authoritative fix commit or release version before upgrading - do not assume a version number beyond what that advisory states. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACK
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated re
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device,
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, perf
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server r
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today