CVE-2025-55086

CRITICAL

Eclipse ThreadX NetX Duo < 6.4.4.202503 - Out-of-bounds Read in DHCPV6 Client

Title source: llm

Description

In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the server reply. With a crafted packet, an attacker could cause an out of memory read.

References (1)

Core 1

Core References

Vendor Advisory

https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-99pw-cp79-2j5j

Scores

CVSS v3 9.8

EPSS 0.0033

EPSS Percentile 24.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-125 CWE-1285

Status published

Products (1)

eclipse/threadx_netx_duo < 6.4.4.202503

Published Oct 20, 2025

Tracked Since Feb 18, 2026