EUVD-2026-89181
GHSA-vhx3-6gpg-5fjw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated single-packet remote trigger gives AV:N/AC:L/PR:N/UI:N; primary impact is agent-thread crash (A:H) with low internal-state corruption (I:L) and no attacker-visible data leak (C:N).
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
3DescriptionCVE.org
hey,
_nx_snmp_utility_object_id_get in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. the OOB bytes are decoded as OID component values and written into the agents internal OID string buffer, corrupting agent state. on systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. on bare metal embedded systems without memory protection the read silently succeeds and corrupts the agents internal state with heap data.
AnalysisAI
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated remote SNMP packet whose object identifier uses BER multibyte length encoding to claim a length larger than the receive buffer, causing _nx_snmp_utility_object_id_get to decode adjacent heap bytes as OID components. On memory-protected (MMU/MPU) builds this faults into a crash of the SNMP agent thread, producing denial of service, while on bare-metal no-MMU targets the out-of-bounds read succeeds silently and instead corrupts the agent's internal OID state with neighboring heap data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the NetX Duo SNMP agent addon to be compiled into the firmware and actively listening (typically UDP/161); this is the key limiting factor since SNMP is not enabled in every NetX Duo build. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional availability risk, not a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed version is pinned in the available data, so the primary action is to take the fix from the vendor advisory GHSA-7qmm-29vg-7hf8 (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-7qmm-29vg-7hf8) and update NetX Duo to the release it identifies as patched, then rebuild and reflash affected firmware. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using Eclipse ThreadX NetX Duo with the SNMP addon compiled in, and if SNMP functionality is not essential, disable the addon or block UDP port 161 at network boundaries; for essential SNMP, restrict access to trusted management IPs via firewall rules and enable logging for SNMP agent crashes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACK
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device,
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, perf
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server r
Eclipse NetX Duo's NetX Secure TLS stack accepts empty application-data records without ever generating or comparing the
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today