CVE-2025-55086: Eclipse ThreadX NetX Duo Buffer Overflow

CVE-2025-55086 Overview

CVE-2025-55086 is an Out-of-Bounds Read vulnerability in the Eclipse Foundation's NetXDuo networking stack, specifically affecting the DHCPv6 client component. The vulnerability exists in versions prior to 6.4.4 where an unchecked index is used when extracting the server DUID (DHCP Unique Identifier) from the server reply. An attacker capable of sending crafted DHCPv6 packets to an affected device can trigger an out-of-bounds memory read condition.

NetXDuo is a critical networking support module for Eclipse ThreadX, a real-time operating system (RTOS) commonly deployed in embedded systems, IoT devices, and industrial control systems. This vulnerability could allow attackers on the same network segment to read sensitive memory contents or potentially cause denial of service conditions in affected embedded devices.

Critical Impact

Attackers can craft malicious DHCPv6 server reply packets to exploit the unchecked index vulnerability, potentially reading arbitrary memory contents or destabilizing embedded systems running ThreadX with NetXDuo.

Affected Products

• Eclipse ThreadX NetXDuo versions prior to 6.4.4
• Embedded systems and IoT devices utilizing NetXDuo DHCPv6 client functionality
• Industrial control systems running ThreadX RTOS with DHCPv6 enabled

Discovery Timeline

• 2025-10-20 - CVE-2025-55086 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2025-55086

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), which occurs when the software reads data past the end of the intended buffer. In the context of NetXDuo's DHCPv6 client implementation, the vulnerability manifests during the parsing of server DUID fields in DHCPv6 reply messages.

The DHCPv6 protocol exchanges DUID values between clients and servers for identification purposes. When the NetXDuo DHCPv6 client receives a server reply, it extracts the server DUID using an index value. The vulnerable code fails to properly validate this index against the bounds of the received packet data, allowing a malicious server or man-in-the-middle attacker to craft packets that cause the client to read beyond allocated memory boundaries.

The network-based attack vector makes this particularly concerning for embedded systems that may be deployed in environments where an attacker can position themselves on the network path or spoof DHCPv6 server responses. While the attack requires some preconditions to be met, no authentication or user interaction is required for exploitation.

Root Cause

The root cause of CVE-2025-55086 is insufficient bounds checking when extracting the server DUID from DHCPv6 reply packets. The DHCPv6 client code uses an index derived from packet data without validating that the index falls within the valid range of the received packet buffer. This allows an attacker to specify an arbitrary index value that causes the code to read memory outside the packet buffer boundaries.

The vulnerability stems from a common programming error in embedded systems where memory safety checks may be omitted for performance reasons or due to assumptions about trusted network input. In network protocol implementations, all external data must be treated as potentially malicious and validated before use.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to send specially crafted DHCPv6 packets to the vulnerable client. The attack can be executed through several scenarios:

The vulnerability occurs during DHCPv6 server DUID extraction from reply packets. An attacker can craft a malicious DHCPv6 reply packet with a manipulated DUID length or offset field, causing the client to read memory beyond the packet buffer. This can be achieved by a rogue DHCPv6 server on the network, through man-in-the-middle attacks on legitimate DHCPv6 traffic, or by exploiting broadcast/multicast DHCPv6 communications.

For detailed technical information, refer to the Eclipse NetXDuo Security Advisory.

Detection Methods for CVE-2025-55086

Indicators of Compromise

• Anomalous DHCPv6 packets with malformed or unusually large DUID fields targeting embedded devices
• Unexpected system crashes or restarts in IoT devices or embedded systems using ThreadX
• Memory corruption indicators or unexpected behavior following DHCPv6 client operations
• Network traffic containing DHCPv6 replies with abnormal option lengths or malformed server identifier options

Detection Strategies

• Deploy network intrusion detection systems (NIDS) with rules to detect malformed DHCPv6 packets, particularly those with oversized or malformed DUID options
• Implement DHCPv6 traffic monitoring to identify suspicious server reply patterns or unexpected DHCPv6 servers on the network
• Utilize SentinelOne Singularity platform to monitor embedded system endpoints for anomalous memory access patterns or crash indicators
• Enable DHCPv6 snooping on network infrastructure to detect and block unauthorized DHCPv6 servers

Monitoring Recommendations

• Monitor DHCPv6 traffic flows for packets with abnormal option lengths or unexpected server DUIDs
• Implement logging on network boundaries to capture DHCPv6 message exchanges for forensic analysis
• Track firmware versions of embedded devices to identify systems running vulnerable NetXDuo versions
• Configure alerting for unexpected DHCPv6 server announcements or reply packets from unauthorized sources

How to Mitigate CVE-2025-55086

Immediate Actions Required

• Identify all deployed embedded systems, IoT devices, and industrial control systems running Eclipse ThreadX with NetXDuo networking stack
• Prioritize patching systems exposed to untrusted network segments or those handling sensitive operations
• Implement network segmentation to isolate vulnerable embedded systems from potentially malicious DHCPv6 traffic
• Consider disabling DHCPv6 client functionality on affected devices where static IPv6 addressing is acceptable

Patch Information

Eclipse Foundation has addressed this vulnerability in NetXDuo version 6.4.4 and later. Organizations should upgrade all affected deployments to the patched version as soon as possible.

For detailed patch information and release notes, refer to the Eclipse NetXDuo Security Advisory.

Workarounds

• Disable DHCPv6 client functionality and configure static IPv6 addresses on affected devices where operationally feasible
• Deploy DHCPv6 guard or snooping features on network switches to filter unauthorized DHCPv6 server responses
• Isolate vulnerable embedded systems on dedicated network segments with strict traffic filtering
• Implement network-level firewall rules to restrict DHCPv6 traffic to known, authorized servers only

# Example network isolation configuration
# Block external DHCPv6 server traffic to embedded device segments
# This example uses iptables/ip6tables syntax

# Allow DHCPv6 only from authorized server
ip6tables -A INPUT -p udp --dport 546 -s fe80::authorized:server -j ACCEPT
ip6tables -A INPUT -p udp --dport 546 -j DROP

# Log dropped DHCPv6 packets for monitoring
ip6tables -A INPUT -p udp --dport 546 -j LOG --log-prefix "DHCPv6_BLOCKED: "