EUVD-2026-89209
GHSA-mmmp-6qxx-j473
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-facing TLS stack (AV:N) but the write only fires on a packet-pool reuse race (AC:H); no auth (PR:N); write-only zeros give C:N/I:L, pool overrun crashes the device (A:H).
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
4DescriptionCVE.org
When NetX Secure is built with NX_SECURE_KEY_CLEAR, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The wipe therefore writes zeros into packets that are free or in use by another thread, and when a reused packet's pointers no longer describe the old data, the length of the wipe underflows and it runs past the end of the packet pool.
AnalysisAI
Memory corruption in the Eclipse ThreadX NetX Duo NetX Secure TLS stack can overrun the packet pool and crash a device, because each outbound TLS record is zeroed after the TCP layer has already taken ownership of - and may have freed and recycled - the underlying packet chain. The defect is a CWE-416 use-after-free write with a length underflow on reused packets, reachable from the network without authentication (CVSSv3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, with the published CVSS 4.0 score of 8.3 reflecting the availability impact). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable ONLY when NetX Secure is compiled with the NX_SECURE_KEY_CLEAR build option - the flaw does not exist in default builds without it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine memory-corruption defect (CWE-416 use-after-free write) in the Eclipse ThreadX NetX Secure TLS layer, but the real-world risk is materially lower than the headline 8.3 CVSS4 suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is not independently confirmed in the supplied data; consult the upstream Eclipse ThreadX NetX Duo security advisory GHSA-8w5x-ff58-2fr2 (https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-8w5x-ff58-2fr2) for the fixed release and upgrade to that version, or verify whether the fix has landed as an upstream PR/commit and backport it, since a released patched version is not confirmed here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all devices and products using Eclipse ThreadX NetX Duo and determine if the NX_SECURE_KEY_CLEAR compile-time option is enabled; if not required, disable it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An out-of-bounds write in Eclipse NetX Duo's WebSocket client allows unauthenticated remote attackers to corrupt NX_PACK
Memory disclosure and denial of service in the Eclipse NetX Duo TFTP server addon (nxd_tftp_server) are reachable by an
Unauthenticated remote attackers can exploit an out-of-bounds read in Eclipse NetX Duo's DTLS ClientHello parser to disc
The SNMP agent addon in Eclipse ThreadX NetX Duo can be driven into an out-of-bounds read by a single unauthenticated re
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
Out-of-bounds reads in the client-side TLS and DTLS handshake parsers of Eclipse ThreadX NetX Duo (NetX Secure) through
NetX Duo (NetX Secure) through 6.5.1.202602 performs a one-byte out-of-bounds read inside the ASN.1 TLV parsing primitiv
Malformed ICMPv6 Neighbor Discovery option parsing in Eclipse NetX Duo can stall the IP thread or read past packet buffe
The FTP client component of Eclipse ThreadX NetX Duo trusts the IPv4 address returned in a server's 227 PASV reply, perf
An out-of-bounds read in the Eclipse NetX Duo TFTP client lets an attacker-controlled or man-in-the-middle TFTP server r
Eclipse NetX Duo's NetX Secure TLS stack accepts empty application-data records without ever generating or comparing the
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today