Threadx Netx Duo
Monthly
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service.
An out-of-bounds read (CWE-125) in the DHCPv6 client of Eclipse NetXDuo before 6.4.4 is triggered when the client parses the server DUID from a reply packet using an unchecked index, allowing a crafted DHCPv6 server response to force an out-of-memory read that can fault or crash the device. Affected deployments are those running NetXDuo with the DHCPv6 client enabled and actively soliciting or processing DHCPv6 replies; because DHCPv6 is link-local, an attacker must operate as a rogue DHCPv6 server or man-in-the-middle on the same local segment rather than reach the target over the open Internet. This is rated medium severity (CVSS 6.3, and an independent assessment of CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), EPSS is low at 0.41% (34th percentile), no CISA KEV listing exists, and no public exploit code has been identified at time of analysis.
Out-of-bounds reads in the Eclipse ThreadX NetX Duo HTTP client module (all versions before 6.4.4) let a malicious, compromised, or man-in-the-middle-positioned server trigger undefined behavior - most plausibly a denial-of-service crash, with limited memory-disclosure potential - by returning crafted HTTP response headers. The flaw is unauthenticated (PR:N) and requires no user interaction, but it only affects devices that act as HTTP clients and connect to an attacker-influenced endpoint, so real-world exposure is situationally gated despite the 8.8 base score; publicly available exploit code exists, while EPSS remains low at 0.61% (47th percentile).
An out-of-bounds read (CWE-125) in Eclipse ThreadX NetX Duo before 6.4.4 allows remote, unauthenticated attackers to read a small amount of adjacent memory when the stack processes a crafted ICMPv6 packet containing options, triggered inside the _nx_icmpv6_validate_options() routine. Only devices running a vulnerable NetX Duo build with IPv6/ICMPv6 handling enabled and reachable over an IPv6 link or routable path are exposed; the scored impact is limited to confidentiality (memory disclosure) with no code execution, modification, or availability impact. No public exploit code has been identified at time of analysis, and EPSS is low at 0.41% (33rd percentile), so exploitation is not confirmed actively exploited.
Crafted SNMPv3 security parameters can drive the SNMP addon of Eclipse ThreadX NetX Duo (versions before 6.4.4) into an out-of-bounds read (CWE-125), allowing remote, unauthenticated attackers who can reach an exposed SNMPv3 agent to read past the bounds of an internal buffer - resulting in limited memory disclosure and possible denial of service through a device crash or reset. The vendor's CVSS 4.0 vector (6.3) and our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) both treat this as a medium-severity, high-complexity issue: the AT:P attack-requirements metric means the over-read depends on specific input values and memory layout rather than succeeding on every request, and exploitation is local to the device only (SC:N/SI:N/SA:N). No public exploit code was identified at time of analysis and CISA KEV does not list this CVE; EPSS is low at 0.46% (38th percentile), consistent with a targeted embedded/OT scenario rather than broad mass exploitation.
Out-of-bounds read in Eclipse ThreadX NetX Duo (all versions before 6.4.4) lets an attacker who can deliver DHCP traffic - a rogue DHCP server, a DHCP relay, or an on-path/same-L2-segment host - trigger an over-read in _nx_ipv4_packet_receive() via a crafted unicast DHCP message, corrupting four bytes of memory on devices that run the IPv4/DHCP client. No authentication or user interaction is required once the packet reaches the client, but the assessed impact is integrity-only, with no confirmed confidentiality or availability effect. No public exploit code and no active exploitation have been identified at time of analysis, and EPSS is low at 0.31% (22nd percentile).
An out-of-bounds read in Eclipse NetX Duo before 6.4.4 allows remote, unauthenticated attackers to disclose small amounts of adjacent memory when the embedded TCP/IP stack parses an inbound IPv4 packet carrying the IP timestamp option. The flaw lives in _nx_ipv4_option_process() and affects devices running the NetX Duo networking module for Eclipse ThreadX with IPv4 enabled and network-reachable; impact is limited to information disclosure (C:L) with no code execution or denial-of-service effect. Exploitation requires the target to actually parse IPv4 options and the attacker has limited control over which memory is leaked, EPSS is a low 0.33% (24th percentile), and no public exploit has been identified at time of analysis, making this a moderate-severity, low-priority issue rather than an urgent one.
An out-of-bounds read in Eclipse ThreadX NetX Duo (all versions before 6.4.4) is triggered in the _nx_ip_packet_receive() path when a malformed Ethernet frame declares EtherType IP but carries no IP payload, causing the parser to read past the end of the received buffer. Exploitation is unauthenticated and needs no user interaction (CVSS 4.0 PR:N/UI:N), but the trigger is a raw layer-2 frame that routers would not forward intact, so realistic exposure requires adjacency to the target's broadcast domain rather than arbitrary internet reach. EPSS is low at 0.37% (29th percentile) and no public exploit code has been identified at time of analysis; the assessed impact is limited information disclosure, with no integrity or availability effect confirmed.
An out-of-bounds read in Eclipse NetX Duo's IPv4 receive path (_nx_ipv4_packet_receive()) can be triggered by delivering a malformed Ethernet frame that carries an IPv4 packet shorter than 4 bytes, causing the stack to over-read the truncated buffer and potentially leak a small amount of adjacent memory. The affected component is the NetX Duo networking support module for Eclipse ThreadX before version 6.4.4, and because the trigger is a crafted link-layer frame, exploitation generally requires an attacker with adjacent-network or link-layer injection position rather than arbitrary internet reachability; the outcome is limited to a minor information disclosure with no integrity or availability impact. No confirmed active exploitation and no public exploit code were identified at time of analysis, and EPSS is low (0.37%, ~29th percentile), consistent with a moderate, not high-priority, issue.
An out-of-bounds memory read exists in Eclipse ThreadX NetX Duo's secure TLS module (all versions before 6.4.4) due to a faulty bound check when parsing the supported_versions extension of an inbound TLS ClientHello. A remote, unauthenticated attacker who can reach a device running NetX Duo as a TLS server/endpoint can trigger the flaw with a crafted ClientHello containing a malformed version field, leaking limited adjacent memory contents (low confidentiality impact only; no confirmed integrity or availability effect). No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.33% (24th percentile), so this is a moderate-priority hardening item rather than an urgent one.
Two-byte out-of-bounds read in Eclipse ThreadX NetX Duo before 6.4.4 allows a remote unauthenticated attacker to send a crafted packet to the affected network-facing parser and read limited adjacent memory or trigger a crash. The exposed impact is confidentiality-only under the independent CVSS:3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); NVD lists a CVSS 4.0 score of 6.9. EPSS is 0.25% (15th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis, so remediation should focus on upgrading to 6.4.4 or later.
An out-of-bounds read in Eclipse Foundation's NetX Duo embedded TCP/IP stack (part of the ThreadX ecosystem) before version 6.4.4 can be triggered by a remote, unauthenticated attacker who sends a crafted TLS ClientHello containing an unvalidated PSK length. The flaw lives in _nx_secure_tls_process_clienthello(), where missing validation of the pre-shared-key length lets the parser read beyond the intended buffer; realistic impact is limited to disclosure of a small amount of adjacent memory or a possible crash rather than memory corruption or remote code execution (CWE-125). Exploitation requires only network reachability to a NetX Duo TLS server endpoint running a vulnerable build, and no public exploit has been identified at time of analysis; EPSS is low at 0.25% (15th percentile) and the issue is not in CISA KEV, so this is a moderate, not urgent, priority.
Out-of-bounds read in Eclipse ThreadX NetX Duo before 6.4.4 allows unauthenticated remote attackers to trigger a limited memory read when the embedded TLS server processes a crafted ClientHello message. The flaw sits in the server-side _nx_secure_tls_process_clienthello() function, which fails to validate the ciphersuite length and compression method length fields; affected devices are those running NetX Duo's secure TLS component in server mode and reachable on the network. No public exploit identified at time of analysis, and EPSS is low at 0.37% (29th percentile); the assessed impact is limited to low confidentiality loss (CVSS 3.1 C:L) with no integrity or availability impact.
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
In NetX Duo component HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially crafted packets. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.
In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could cause an integer wrap-around and an allocation smaller than expected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service.
An out-of-bounds read (CWE-125) in the DHCPv6 client of Eclipse NetXDuo before 6.4.4 is triggered when the client parses the server DUID from a reply packet using an unchecked index, allowing a crafted DHCPv6 server response to force an out-of-memory read that can fault or crash the device. Affected deployments are those running NetXDuo with the DHCPv6 client enabled and actively soliciting or processing DHCPv6 replies; because DHCPv6 is link-local, an attacker must operate as a rogue DHCPv6 server or man-in-the-middle on the same local segment rather than reach the target over the open Internet. This is rated medium severity (CVSS 6.3, and an independent assessment of CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), EPSS is low at 0.41% (34th percentile), no CISA KEV listing exists, and no public exploit code has been identified at time of analysis.
Out-of-bounds reads in the Eclipse ThreadX NetX Duo HTTP client module (all versions before 6.4.4) let a malicious, compromised, or man-in-the-middle-positioned server trigger undefined behavior - most plausibly a denial-of-service crash, with limited memory-disclosure potential - by returning crafted HTTP response headers. The flaw is unauthenticated (PR:N) and requires no user interaction, but it only affects devices that act as HTTP clients and connect to an attacker-influenced endpoint, so real-world exposure is situationally gated despite the 8.8 base score; publicly available exploit code exists, while EPSS remains low at 0.61% (47th percentile).
An out-of-bounds read (CWE-125) in Eclipse ThreadX NetX Duo before 6.4.4 allows remote, unauthenticated attackers to read a small amount of adjacent memory when the stack processes a crafted ICMPv6 packet containing options, triggered inside the _nx_icmpv6_validate_options() routine. Only devices running a vulnerable NetX Duo build with IPv6/ICMPv6 handling enabled and reachable over an IPv6 link or routable path are exposed; the scored impact is limited to confidentiality (memory disclosure) with no code execution, modification, or availability impact. No public exploit code has been identified at time of analysis, and EPSS is low at 0.41% (33rd percentile), so exploitation is not confirmed actively exploited.
Crafted SNMPv3 security parameters can drive the SNMP addon of Eclipse ThreadX NetX Duo (versions before 6.4.4) into an out-of-bounds read (CWE-125), allowing remote, unauthenticated attackers who can reach an exposed SNMPv3 agent to read past the bounds of an internal buffer - resulting in limited memory disclosure and possible denial of service through a device crash or reset. The vendor's CVSS 4.0 vector (6.3) and our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) both treat this as a medium-severity, high-complexity issue: the AT:P attack-requirements metric means the over-read depends on specific input values and memory layout rather than succeeding on every request, and exploitation is local to the device only (SC:N/SI:N/SA:N). No public exploit code was identified at time of analysis and CISA KEV does not list this CVE; EPSS is low at 0.46% (38th percentile), consistent with a targeted embedded/OT scenario rather than broad mass exploitation.
Out-of-bounds read in Eclipse ThreadX NetX Duo (all versions before 6.4.4) lets an attacker who can deliver DHCP traffic - a rogue DHCP server, a DHCP relay, or an on-path/same-L2-segment host - trigger an over-read in _nx_ipv4_packet_receive() via a crafted unicast DHCP message, corrupting four bytes of memory on devices that run the IPv4/DHCP client. No authentication or user interaction is required once the packet reaches the client, but the assessed impact is integrity-only, with no confirmed confidentiality or availability effect. No public exploit code and no active exploitation have been identified at time of analysis, and EPSS is low at 0.31% (22nd percentile).
An out-of-bounds read in Eclipse NetX Duo before 6.4.4 allows remote, unauthenticated attackers to disclose small amounts of adjacent memory when the embedded TCP/IP stack parses an inbound IPv4 packet carrying the IP timestamp option. The flaw lives in _nx_ipv4_option_process() and affects devices running the NetX Duo networking module for Eclipse ThreadX with IPv4 enabled and network-reachable; impact is limited to information disclosure (C:L) with no code execution or denial-of-service effect. Exploitation requires the target to actually parse IPv4 options and the attacker has limited control over which memory is leaked, EPSS is a low 0.33% (24th percentile), and no public exploit has been identified at time of analysis, making this a moderate-severity, low-priority issue rather than an urgent one.
An out-of-bounds read in Eclipse ThreadX NetX Duo (all versions before 6.4.4) is triggered in the _nx_ip_packet_receive() path when a malformed Ethernet frame declares EtherType IP but carries no IP payload, causing the parser to read past the end of the received buffer. Exploitation is unauthenticated and needs no user interaction (CVSS 4.0 PR:N/UI:N), but the trigger is a raw layer-2 frame that routers would not forward intact, so realistic exposure requires adjacency to the target's broadcast domain rather than arbitrary internet reach. EPSS is low at 0.37% (29th percentile) and no public exploit code has been identified at time of analysis; the assessed impact is limited information disclosure, with no integrity or availability effect confirmed.
An out-of-bounds read in Eclipse NetX Duo's IPv4 receive path (_nx_ipv4_packet_receive()) can be triggered by delivering a malformed Ethernet frame that carries an IPv4 packet shorter than 4 bytes, causing the stack to over-read the truncated buffer and potentially leak a small amount of adjacent memory. The affected component is the NetX Duo networking support module for Eclipse ThreadX before version 6.4.4, and because the trigger is a crafted link-layer frame, exploitation generally requires an attacker with adjacent-network or link-layer injection position rather than arbitrary internet reachability; the outcome is limited to a minor information disclosure with no integrity or availability impact. No confirmed active exploitation and no public exploit code were identified at time of analysis, and EPSS is low (0.37%, ~29th percentile), consistent with a moderate, not high-priority, issue.
An out-of-bounds memory read exists in Eclipse ThreadX NetX Duo's secure TLS module (all versions before 6.4.4) due to a faulty bound check when parsing the supported_versions extension of an inbound TLS ClientHello. A remote, unauthenticated attacker who can reach a device running NetX Duo as a TLS server/endpoint can trigger the flaw with a crafted ClientHello containing a malformed version field, leaking limited adjacent memory contents (low confidentiality impact only; no confirmed integrity or availability effect). No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.33% (24th percentile), so this is a moderate-priority hardening item rather than an urgent one.
Two-byte out-of-bounds read in Eclipse ThreadX NetX Duo before 6.4.4 allows a remote unauthenticated attacker to send a crafted packet to the affected network-facing parser and read limited adjacent memory or trigger a crash. The exposed impact is confidentiality-only under the independent CVSS:3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); NVD lists a CVSS 4.0 score of 6.9. EPSS is 0.25% (15th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis, so remediation should focus on upgrading to 6.4.4 or later.
An out-of-bounds read in Eclipse Foundation's NetX Duo embedded TCP/IP stack (part of the ThreadX ecosystem) before version 6.4.4 can be triggered by a remote, unauthenticated attacker who sends a crafted TLS ClientHello containing an unvalidated PSK length. The flaw lives in _nx_secure_tls_process_clienthello(), where missing validation of the pre-shared-key length lets the parser read beyond the intended buffer; realistic impact is limited to disclosure of a small amount of adjacent memory or a possible crash rather than memory corruption or remote code execution (CWE-125). Exploitation requires only network reachability to a NetX Duo TLS server endpoint running a vulnerable build, and no public exploit has been identified at time of analysis; EPSS is low at 0.25% (15th percentile) and the issue is not in CISA KEV, so this is a moderate, not urgent, priority.
Out-of-bounds read in Eclipse ThreadX NetX Duo before 6.4.4 allows unauthenticated remote attackers to trigger a limited memory read when the embedded TLS server processes a crafted ClientHello message. The flaw sits in the server-side _nx_secure_tls_process_clienthello() function, which fails to validate the ciphersuite length and compression method length fields; affected devices are those running NetX Duo's secure TLS component in server mode and reachable on the network. No public exploit identified at time of analysis, and EPSS is low at 0.37% (29th percentile); the assessed impact is limited to low confidentiality loss (CVSS 3.1 C:L) with no integrity or availability impact.
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
In NetX Duo component HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity.
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially crafted packets. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.
In Eclipse ThreadX NetX Duo before 6.4.0, if an attacker can control parameters of __portable_aligned_alloc() could cause an integer wrap-around and an allocation smaller than expected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.