Vulnerabilidades do Eclipse Foundation Threadx Netx Duo

CVE-2026-103416 Crítica · 9.3 CWE-787 07/10/2026

Out-of-bounds Write em Eclipse Foundation Threadx Netx Duo

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.

CVE-2026-11576 Alta · 7.5 CWE-459 19/06/2026

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling…

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

CVE-2025-55102 Alta · 7.5 CWE-400 27/01/2026

Uncontrolled Resource Consumption em Eclipse Foundation Threadx Netx Duo

A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.

CVE-2025-55086 Crítica · 9.8 CWE-125 20/10/2025

Out-of-bounds Read em Eclipse Foundation Threadx Netx Duo

In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the server reply. With a crafted packet, an attacker could cause an out of memory read.

CVE-2025-55085 Alta · 7.5 CWE-125 17/10/2025

Web http client: Unchecked Server-Side Malicious Packet Issue

In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior.

CVE-2025-55094 Alta · 7.5 CWE-125 17/10/2025

Potential out-of-bounds read in _nx_icmpv6_validate_options()

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_icmpv6_validate_options() when handling a packet with ICMP6 options.

CVE-2025-55087 Alta · 7.5 CWE-125 17/10/2025

Out-of-bounds Read em Eclipse Foundation Threadx Netx Duo

In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by a crafted SNMPv3 security parameters.

CVE-2025-55093 Média · 5.3 CWE-125 17/10/2025

Out of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messages

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() when handling unicast DHCP messages that could cause corruption of 4 bytes of memory.

CVE-2025-55092 Média · 5.3 CWE-125 17/10/2025

Potential out of bound read in _nx_ipv4_option_process()

In Eclipse Foundation NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_option_process() when processing an IPv4 packet with the timestamp option.

CVE-2025-55091 Média · 6.5 CWE-125 16/10/2025

Potential out of bound read in _nx_ip_packet_receive()

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ip_packet_receive() function when received an Ethernet with type set as IP but no IP data.

CVE-2025-55090 Média · 6.5 CWE-125 16/10/2025

Potential out of bound read issue in _nx_ipv4_packet_receive() in NetX Duo

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() function when received an Ethernet frame with less than 4 bytes of IP packet.

CVE-2025-55084 Média · 5.3 CWE-126 16/10/2025

Out of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_versions_extension() in the extension version field.

CVE-2025-55083 Média · 5.3 CWE-126 15/10/2025

Broken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check resulting it out by two out of bound read.

CVE-2025-55082 Média · 5.3 CWE-125 15/10/2025

Potential out of bound read and info leak in_nx_secure_tls_psk_identity_find()

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was a potential out of bound read in _nx_secure_tls_process_clienthello() because of a missing validation of PSK length provided in the user message.

CVE-2025-55081 Crítica · 9.1 CWE-125 15/10/2025

Potential out of bound read in _nx_secure_tls_process_clienthello()

In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of certain SSL/TLS client hello message: the ciphersuite length and compression method length. In case of an attacker-crafted message with values outside of the expected range, it could cause an out-of-bound read.