CVE-2025-55083: Eclipse ThreadX NetX Duo Overflow Flaw

CVE-2025-55083 Overview

CVE-2025-55083 is an out-of-bounds read vulnerability in Eclipse ThreadX NetX Duo, the embedded TCP/IP networking stack used with the ThreadX real-time operating system. The flaw affects NetX Duo versions before 6.4.4 and stems from an incorrect bound check that reads two bytes beyond the intended buffer. The issue is tracked as CWE-126: Buffer Over-read and is reachable over the network without authentication or user interaction. Successful exploitation exposes small amounts of adjacent memory content, which can support information disclosure against embedded and Internet of Things (IoT) devices running the affected stack.

Critical Impact
Remote, unauthenticated attackers can trigger a two-byte out-of-bounds read in NetX Duo, potentially disclosing adjacent memory from embedded devices.

Affected Products

Eclipse ThreadX NetX Duo versions prior to 6.4.4
Embedded and IoT firmware built on ThreadX using the NetX Duo networking component
Devices exposing NetX Duo network services to untrusted networks

Discovery Timeline

2025-10-15 - CVE-2025-55083 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55083

Vulnerability Analysis

The vulnerability is a buffer over-read in the NetX Duo network stack maintained by the Eclipse Foundation as part of the ThreadX project. According to the advisory, an incorrect bound check causes the code to read two bytes past the end of the intended buffer when processing network input. Because NetX Duo runs inside the same address space as the rest of the embedded application, adjacent memory may include protocol state, control structures, or other sensitive runtime data. The scope is limited: the flaw affects confidentiality only, with no direct impact on integrity or availability per the published metrics. In practice, attackers use over-reads like this to leak addresses, bypass mitigations, or chain into more serious memory-corruption primitives.

Root Cause

The root cause is an off-by-two boundary check in a NetX Duo parsing path. The comparison used to validate the read length permits access to two bytes beyond the allocated region. This is a classic CWE-126 pattern where the terminator or length field is not accounted for correctly, allowing the read pointer to advance past the last valid offset.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted packet to a service that uses the vulnerable NetX Duo parsing routine. The stack then reads two bytes outside the source buffer while processing that input. Because embedded devices frequently expose NetX Duo services directly to LAN or WAN interfaces, exploitation does not require prior foothold on the target.

No verified proof-of-concept code has been published. Refer to the Eclipse ThreadX NetX Duo Security Advisory GHSA-9hw5-4xcv-jprm for the maintainer's technical description.

Detection Methods for CVE-2025-55083

Indicators of Compromise

Malformed or truncated NetX Duo protocol packets targeting embedded devices at the edge of the network
Unexpected outbound traffic from IoT devices containing fragments of adjacent memory content
Repeated connection attempts to NetX Duo services from a single external source probing parser boundaries

Detection Strategies

Inventory firmware builds and identify devices linked against NetX Duo versions earlier than 6.4.4
Deploy network intrusion detection signatures for anomalous packet lengths and boundary values targeting ThreadX-based endpoints
Correlate device firmware versions with vulnerability data in an asset management or SIEM platform to surface exposed hosts

Monitoring Recommendations

Log and inspect traffic to and from IoT and operational technology (OT) segments that host ThreadX devices
Alert on protocol-level anomalies such as invalid length fields, unexpected option sizes, or malformed headers hitting embedded services
Track vendor firmware advisories for downstream products that bundle NetX Duo and republish under their own version numbers

How to Mitigate CVE-2025-55083

Immediate Actions Required

Upgrade NetX Duo to version 6.4.4 or later and rebuild affected firmware images
Identify all embedded products in the environment that ship NetX Duo and request patched firmware from device vendors
Restrict network exposure of ThreadX-based devices to trusted management segments until patched builds are deployed

Patch Information

The Eclipse ThreadX project fixed the incorrect bound check in NetX Duo 6.4.4. Consult the GitHub Security Advisory GHSA-9hw5-4xcv-jprm for the corrected code and release notes. Vendors that integrate NetX Duo must rebuild and redistribute firmware images to downstream devices.

Workarounds

Segment ThreadX devices behind firewalls that block untrusted inbound traffic to NetX Duo services
Disable or filter the specific NetX Duo protocol features that are not required for device operation
Apply strict ingress filtering on packet length and protocol option fields at network boundaries where firmware updates cannot yet be applied

bash

# Configuration example: restrict inbound access to ThreadX device segment
# Replace interface and subnet values to match the environment
iptables -A FORWARD -i eth0 -d 10.20.30.0/24 -m state --state NEW -j DROP
iptables -A FORWARD -i mgmt0 -d 10.20.30.0/24 -m state --state NEW -j ACCEPT