EUVD-2026-89185
GHSA-5cxq-44w6-64mx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network attacker acting as the TFTP server needs no interaction (AC:L/PR:N/UI:N); OOB read yields low confidentiality leak and possible crash (C:L/A:L), no write so I:N.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
2DescriptionCVE.org
A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the
received datagram.
Each receive path checks only that the datagram is at least four bytes long (nxd_tftp_client.c:1229,
1521, 1984). When the opcode is NX_TFTP_CODE_ERROR the message string is copied with a loop whose
only limits are the destination buffer and a NUL byte:
/* addons/tftp/nxd_tftp_client.c:1769 */
for (i = 0; (i < (sizeof(tftp_client_ptr -> nx_tftp_client_error_string) - 1)) && (*buffer_ptr); i++)
Nothing compares buffer_ptr against nx_packet_append_ptr. An ERROR packet that carries no
terminating NUL, which a server controls completely, walks the loop off the end of the packet until
it happens to meet a zero byte or fills the 64 byte destination.
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1 at 0x60d0000000c8 thread T4
#0 _nxd_tftp_client_file_read addons/tftp/nxd_tftp_client.c:1769
0x60d0000000c8 is 0 bytes to the right of 136-byte region
The open path has the same loop at :1327 and reports the same way. What is read lands in
nx_tftp_client_error_string, which the application is expected to display or log, so adjacent
packet pool memory ends up in whatever the device does with the error text.
Add (buffer_ptr < packet_ptr -> nx_packet_append_ptr) to the loop condition in all three paths.
AnalysisAI
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server return a short ERROR packet that causes the client to read up to 64 bytes past the received datagram. The vulnerable receive paths are in the TFTP client add-on and an unauthenticated remote attacker can trigger the condition when a device initiates a TFTP read or open against the attacker's server, potentially disclosing adjacent packet-pool memory if the application logs or displays nx_tftp_client_error_string, and potentially causing a crash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the device to run the NetX Duo TFTP CLIENT (addons/tftp) and to initiate a TFTP read or open against a server the attacker controls or can machine-in-the-middle on the transfer path; the server then returns an ERROR-opcode packet whose message string is not NUL-terminated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are internally consistent but point to a moderate, not critical, issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-provided code fix in the GitHub security advisory GHSA-wvc9-5m9h-rvxc: add the condition (buffer_ptr < packet_ptr->nx_packet_append_ptr) to the error-string copy loop in all three affected receive paths, or upgrade to a NetX Duo release that contains this bounds check; a released patched version is not independently confirmed in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACK
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated re
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device,
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, perf
Eclipse NetX Duo's NetX Secure TLS stack accepts empty application-data records without ever generating or comparing the
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today