CVE-2025-55084 Overview
CVE-2025-55084 is an out-of-bounds read vulnerability in Eclipse Foundation ThreadX NetX Duo, a widely deployed TCP/IP network stack for embedded and real-time operating systems. The flaw resides in the _nx_secure_tls_proc_clienthello_supported_versions_extension() function, which performs an incorrect bound check on the extension version field during TLS handshake processing. Versions of NetX Duo prior to 6.4.4 are affected. The issue is classified under CWE-126: Buffer Over-read and is network-exploitable without authentication or user interaction.
Critical Impact
Unauthenticated remote attackers can send a crafted TLS ClientHello message to trigger an out-of-bounds read in the supported versions extension parser, potentially causing information disclosure or denial of service on embedded devices running vulnerable NetX Duo builds.
Affected Products
- Eclipse ThreadX NetX Duo versions before 6.4.4
- Embedded systems and IoT devices bundling ThreadX NetX Duo TLS stack
- Products integrating the Eclipse Foundation ThreadX real-time operating system with TLS support
Discovery Timeline
- 2025-10-16 - CVE-2025-55084 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55084
Vulnerability Analysis
The vulnerability exists in the TLS server-side processing of the ClientHello supported versions extension. When a TLS client sends this extension, the NetX Duo parser reads the length field and iterates through the advertised protocol versions. The function _nx_secure_tls_proc_clienthello_supported_versions_extension() fails to correctly validate the extension version field against the remaining buffer length before dereferencing memory. An attacker who initiates a TLS handshake with a malformed supported versions extension can force the parser to read beyond the intended buffer boundary. The confidentiality impact is limited to low, per the CVSS vector, indicating that the leaked data is constrained to adjacent memory regions rather than arbitrary process memory.
Root Cause
The root cause is an incorrect boundary check inside the extension version field parsing routine. The function trusts client-supplied length or offset values without ensuring they remain within the ClientHello record. This pattern is a classic [CWE-126] buffer over-read where sanity checks are either missing or use incorrect comparison operators.
Attack Vector
Exploitation requires network reachability to a TLS endpoint running vulnerable NetX Duo firmware. No authentication or user interaction is needed. The attacker crafts a TLS ClientHello containing a malformed supported_versions extension with a length or version count that exceeds the remaining record bytes. When the vulnerable parser processes the extension, it reads beyond the buffer, which may leak stack or heap contents into subsequent protocol responses, or trigger a memory fault on strictly enforced platforms.
No verified proof-of-concept code is publicly available. See the Eclipse ThreadX NetX Duo GitHub Security Advisory GHSA-m474-39rw-v8gm for the vendor description.
Detection Methods for CVE-2025-55084
Indicators of Compromise
- Unexpected TLS handshake failures or device resets on embedded assets running ThreadX NetX Duo TLS listeners
- Inbound TLS ClientHello messages containing malformed supported_versions (extension type 0x002b) with length fields inconsistent with the outer extension length
- Repeated TLS handshake attempts from a single source targeting embedded management or telemetry ports
Detection Strategies
- Deploy TLS-aware network intrusion detection signatures that validate the internal length fields of the supported_versions extension against the containing record
- Inventory firmware and third-party components to identify devices shipping NetX Duo below version 6.4.4
- Correlate device crash reports and watchdog reboots with inbound TLS traffic from untrusted sources
Monitoring Recommendations
- Log and alert on abnormal TLS handshake termination rates on embedded device fleets
- Monitor egress from embedded devices for anomalous data patterns that could indicate memory disclosure
- Track vendor firmware advisories referencing ThreadX or NetX Duo component updates
How to Mitigate CVE-2025-55084
Immediate Actions Required
- Upgrade Eclipse ThreadX NetX Duo to version 6.4.4 or later and rebuild affected firmware images
- Restrict network exposure of embedded TLS services to trusted management networks until patched firmware is deployed
- Coordinate with device vendors and OEMs to obtain patched firmware for downstream products that embed NetX Duo
Patch Information
The fix is included in NetX Duo 6.4.4. Refer to the Eclipse ThreadX NetX Duo GitHub Security Advisory GHSA-m474-39rw-v8gm for the corrected bounds check in _nx_secure_tls_proc_clienthello_supported_versions_extension() and rebuild instructions for downstream integrators.
Workarounds
- Place vulnerable devices behind a TLS-terminating reverse proxy or firewall that normalizes and validates ClientHello extensions
- Disable inbound TLS server functionality on devices where it is not required
- Apply network ACLs to limit which clients can initiate TLS handshakes with affected embedded endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
