Eclipse ThreadX NetX Duo any version

Integer wraparound, under-allocation, and heap buffer overflow in Eclipse ThreadX NetX Duo __portable_aligned_alloc()

In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the server reply. With a crafted packet, an attacker could cause an out of memory read.

Potential out of bound read in _nx_secure_tls_process_clienthello()

Web http client: Unchecked Server-Side Malicious Packet Issue

A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.

Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

Eclipse ThreadX NetX Duo component HTTP server single PUT request integer underflow

Eclipse ThreadX NetX Duo HTTP component server denial of service

Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

Eclipse ThreadX NetX Duo HTTP server denial of service

Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.

In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by a crafted SNMPv3 security parameters.

Potential out-of-bounds read in _nx_icmpv6_validate_options()

Potential out of bound read issue in _nx_ipv4_packet_receive() in NetX Duo

Potential out of bound read in _nx_ip_packet_receive()

Out of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()

Potential out of bound read in _nx_ipv4_option_process()

Out of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messages

Broken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()

Potential out of bound read and info leak in_nx_secure_tls_psk_identity_find()