CVE-2025-55086

In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the server reply. With a crafted packet, an attacker could cause an out of memory read.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-99pw-cp79-2j5j	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:*

History

08 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) En la versión de NetXDuo anterior a la 6.4.4, un módulo de soporte de red para Eclipse Foundation ThreadX, en el cliente DHCPV6 había un índice sin verificar que extraía el DUID del servidor de la respuesta del servidor. Con un paquete manipulado, un atacante podría causar una lectura fuera de memoria.

Information

Published : 2025-10-20 18:15

Updated : 2026-10-08 22:10

NVD link : CVE-2025-55086

Mitre link : CVE-2025-55086

CVE.ORG link : CVE-2025-55086

JSON object : View

Products Affected

eclipse

threadx_netx_duo

CWE

CWE-125

Out-of-bounds Read

CWE-1285

Improper Validation of Specified Index, Position, or Offset in Input

{"id": "CVE-2025-55086", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55086", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-20T20:23:06.785452Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "NextX Duo", "versions": [{"status": "affected", "version": "0", "lessThan": "6.4.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-20T18:15:39.813", "references": [{"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-99pw-cp79-2j5j", "tags": ["Vendor Advisory"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-1285"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the server reply. With a crafted packet, an attacker could cause an out of memory read."}, {"lang": "es", "value": "En la versi\u00f3n de NetXDuo anterior a la 6.4.4, un m\u00f3dulo de soporte de red para Eclipse Foundation ThreadX, en el cliente DHCPV6 hab\u00eda un \u00edndice sin verificar que extra\u00eda el DUID del servidor de la respuesta del servidor. Con un paquete manipulado, un atacante podr\u00eda causar una lectura fuera de memoria."}], "lastModified": "2026-10-08T22:10:00.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24743F34-C00F-4CB2-BCEE-2BB29FA265CB", "versionEndExcluding": "6.4.4.202503"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}