EUVD-2026-89199
GHSA-m9v4-gw5f-8cg7
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated, but AC:H captures the connection race and UI:R the required in-progress transfer; impact is confidentiality-only (data channel disclosure), no integrity/availability.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
3DescriptionCVE.org
FTP Passive Data Connection Not Bound to the Authenticated Control Peer
AnalysisAI
Information disclosure in the Eclipse ThreadX NetX Duo embedded TCP/IP stack's FTP server addon lets a network attacker consume data belonging to an authenticated FTP session, because the server never ties the passive-mode data connection back to the peer on the control channel. Exploiting this requires the target to be running the NetX Duo FTP server and a client to be performing or negotiating a passive-mode transfer at the moment of attack, and the attacker must reach the announced passive port and win a connection race against the legitimate client before it connects; no authentication is required (PR:N), but the timing dependency makes complexity high (AC:H, UI:P) and the impact is limited to confidentiality (C:H/I:N/A:N, CVSS 4.0 base 6.0). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to run the NetX Duo FTP server addon and a client to be performing (or negotiating) a passive-mode data transfer at the moment of attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority confidentiality flaw, not an inflated high-CVSS issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix referenced in the Eclipse ThreadX NetX Duo security advisory GHSA-r2qx-83vg-xqx4 (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-r2qx-83vg-xqx4), which addresses the missing binding of the passive data connection to the authenticated control peer; the intelligence supplied here does not name a specific fixed version, so the advisory should be consulted for the exact release to upgrade to, and for embedded deployments the patched NetX Duo source must be rebuilt into the device firmware. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Wing FTP Server before 7.4.4 contains a critical remote code execution vulnerability (CVE-2025-47812, CVSS 10.0) through
Critical buffer overflow vulnerability in the NOOP Command Handler of FreeFloat FTP Server 1.0 that allows remote, unaut
The FTP (aka "Implementation of a simple FTP client and server") project through 96c1a35 allows remote attackers to caus
Critical buffer overflow vulnerability in PCMan FTP Server 2.0.7's SYSTEM Command Handler that allows unauthenticated re
Critical buffer overflow vulnerability in the SET Command Handler of PCMan FTP Server 2.0.7 that allows remote attackers
A buffer overflow vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available
Critical buffer overflow vulnerability in the HOST Command Handler of FreeFloat FTP Server 1.0 that allows unauthenticat
Critical buffer overflow vulnerability in FreeFloat FTP Server 1.0's SYSTEM Command Handler that allows unauthenticated
Critical buffer overflow vulnerability in the PASV command handler of FreeFloat FTP Server 1.0 that allows unauthenticat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today