EUVD-2026-89187
GHSA-p9rr-8wmf-9r7v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious FTP server unauthenticatedly redirects the client's data connection to an arbitrary host (SSRF, scope change), with only low confidentiality exposure and no integrity or availability impact.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
2DescriptionCVE.org
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.
AnalysisAI
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, performing only parse and non-zero checks before opening a data connection to that address, which lets a malicious or man-in-the-middle FTP server redirect the client's data transfer to any host it names (CWE-918 server-side request forgery class). Only the IPv4 passive-mode path is affected; the client must itself initiate an FTP control session to a hostile or intercepted endpoint and then request a passive transfer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the NetX Duo FTP client component to be in use and to establish an IPv4 control connection to an attacker-controlled or man-in-the-middle FTP server; the client must then perform a passive-mode (PASV) transfer so the malicious server can return a crafted `227` reply. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CWE-918 SSRF-style flaw in the FTP client of Eclipse ThreadX NetX Duo, where the IPv4 PASV code path trusts the address supplied in the server's `227` reply after only validating that it parses and is non-zero, allowing a malicious or MITM FTP server to redirect the client's data connection to an arbitrary address. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status could not be confirmed from the available data: no exact fixed release, GitHub PR, or commit is provided in the input, so integrators should consult the upstream Eclipse ThreadX advisory GHSA-j6g2-8fm3-rm8m (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-j6g2-8fm3-rm8m) for the vendor-released fix version and apply it as soon as it is available for the NetX Duo version in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACK
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated re
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device,
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server r
Eclipse NetX Duo's NetX Secure TLS stack accepts empty application-data records without ever generating or comparing the
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today