EUVD-2026-37999Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Reachable over the network via HTTP PUT with no auth or user interaction; trigger is a simple malformed request, and impact is service crash with no confidentiality or integrity loss.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
1DescriptionCVE.org
The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.
AnalysisAI
Denial of service in Eclipse ThreadX NetX Duo HTTP server arises from a flawed remediation of CVE-2025-0728, where the refactored shared cleanup label invokes fx_file_close() on an uninitialized file handle whenever an error occurs before file open. Remote attackers can reach the vulnerable PUT path over the network without authentication, triggering undefined behavior, double-close conditions, or memory corruption that can crash the embedded HTTP service. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Eclipse ThreadX NetX Duo is the TCP/IP networking stack bundled with the Eclipse ThreadX real-time operating system, widely deployed on resource-constrained embedded and IoT devices. The bug lives in the NetX Duo HTTP server's PUT request handler, which uses FileX (fx_file_close) for filesystem operations. The root cause maps to CWE-415 (Double Free) and is a classic regression introduced by a 'goto cleanup' refactor: multiple early error branches jump to a unified cleanup label that unconditionally tears down resources without tracking which were actually acquired, so fx_file_close() runs against a FX_FILE structure that was never initialized via fx_file_open(). On embedded targets without MMU protection, operating on uninitialized control structures readily corrupts heap or stack memory, and the absence of address-space randomization or guard pages typical of MCUs makes the consequences deterministic for an attacker probing a known firmware build.
RemediationAI
No vendor-released patch version is identified at time of analysis in the provided data, so consult the Eclipse security advisory at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/123 and the eclipse-threadx/netxduo GitHub repository for the corrective commit that gates fx_file_close() on a successful prior fx_file_open(), then rebuild and reflash affected firmware once a tagged release is available. As compensating controls until a fix is deployed, disable the NetX Duo HTTP server PUT method or the HTTP server entirely on devices that do not require file upload (trade-off: breaks any in-band firmware-upload or configuration-upload feature that relies on PUT); restrict TCP access to the HTTP server port to a trusted management VLAN or jump host via upstream firewall/ACL (trade-off: blocks legitimate remote management from outside that segment); and if device firmware exposes an option to require authentication on the HTTP server, enable it to raise the attack precondition (trade-off: still does not eliminate the bug if authenticated users can reach PUT). Do not rely on the CVE-2025-0728 fix alone - that fix is what introduced this regression.
Same weakness CWE-415 – Double Free
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today