Eclipse Threadx Netxduo
Monthly
Unauthenticated remote clients can exhaust the packet pool of the Eclipse ThreadX NetX Duo RTSP server addon, causing a denial of service: roughly two dozen RTSP requests carrying a Session header value that the parser cannot convert (empty or non-numeric) leak one packet block each until the pool hits zero and the server can no longer serve any client. The leak occurs because the Session branch of _nx_rtsp_server_error_response_send's caller returns the raw NetX error code instead of mapping it to an RTSP status, and the error-response path then drops the already-allocated response packet on that unrecognized code. No public exploit identified at time of analysis, and no CISA KEV entry was provided; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote, unauthenticated, availability-only impact, with blast radius worst when the RTSP server shares its packet pool with the rest of the application, as in the shipped sample (22-block pool exhausted by ~26 requests).
Heap out-of-bounds write in the mDNS responder of Eclipse ThreadX NetX Duo allows an unauthenticated attacker on the same local network segment to corrupt packet memory by sending two ordinary mDNS PTR records in response to a _http._tcp service query. The flaw arises from a string-table bucket collision: owner names of 12-15 characters round to the same slot size, causing the responder to reuse a shorter stored entry and write 1-3 bytes past the transmit packet's data end. With the mDNS addon active and adjacency to the target, the realistic impact is denial of service through corrupted neighboring packets or pool free lists, though code execution is not demonstrated; no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds heap read in the DHCP client addon of Eclipse ThreadX NetX Duo (nxd_dhcp_client.c) allows an attacker on the same local link to disclose adjacent heap memory whenever a device performs a DHCP acquisition. The attacker only needs to be a DHCP server, or any LAN host that wins the race to answer the client's broadcast DISCOVER first, and to reply with a single OFFER containing a long run of skippable TLV options; a malformed option layout causes the parser's offset counter to lag the actual read pointer, producing a read roughly a kilobyte and beyond past the end of the message (a one-byte read 164 bytes past a 1648-byte heap region in the reported AddressSanitizer trace). The issue occurs unauthenticated (CVSS PR:N), from an adjacent network (AV:A), on every boot while the interface is unconfigured, with bounded impact limited to low confidentiality and low availability (CVSS 5.3); no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote clients can exhaust the packet pool of the Eclipse ThreadX NetX Duo RTSP server addon, causing a denial of service: roughly two dozen RTSP requests carrying a Session header value that the parser cannot convert (empty or non-numeric) leak one packet block each until the pool hits zero and the server can no longer serve any client. The leak occurs because the Session branch of _nx_rtsp_server_error_response_send's caller returns the raw NetX error code instead of mapping it to an RTSP status, and the error-response path then drops the already-allocated response packet on that unrecognized code. No public exploit identified at time of analysis, and no CISA KEV entry was provided; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote, unauthenticated, availability-only impact, with blast radius worst when the RTSP server shares its packet pool with the rest of the application, as in the shipped sample (22-block pool exhausted by ~26 requests).
Heap out-of-bounds write in the mDNS responder of Eclipse ThreadX NetX Duo allows an unauthenticated attacker on the same local network segment to corrupt packet memory by sending two ordinary mDNS PTR records in response to a _http._tcp service query. The flaw arises from a string-table bucket collision: owner names of 12-15 characters round to the same slot size, causing the responder to reuse a shorter stored entry and write 1-3 bytes past the transmit packet's data end. With the mDNS addon active and adjacency to the target, the realistic impact is denial of service through corrupted neighboring packets or pool free lists, though code execution is not demonstrated; no public exploit code or active exploitation has been identified at time of analysis.
An out-of-bounds heap read in the DHCP client addon of Eclipse ThreadX NetX Duo (nxd_dhcp_client.c) allows an attacker on the same local link to disclose adjacent heap memory whenever a device performs a DHCP acquisition. The attacker only needs to be a DHCP server, or any LAN host that wins the race to answer the client's broadcast DISCOVER first, and to reply with a single OFFER containing a long run of skippable TLV options; a malformed option layout causes the parser's offset counter to lag the actual read pointer, producing a read roughly a kilobyte and beyond past the end of the message (a one-byte read 164 bytes past a 1648-byte heap region in the reported AddressSanitizer trace). The issue occurs unauthenticated (CVSS PR:N), from an adjacent network (AV:A), on every boot while the interface is unconfigured, with bounded impact limited to low confidentiality and low availability (CVSS 5.3); no public exploit code or confirmed active exploitation was identified at time of analysis.