CVE-2025-55091: Eclipse ThreadX NetX Duo Buffer Overflow

CVE-2025-55091 Overview

CVE-2025-55091 is an out-of-bounds read vulnerability in Eclipse ThreadX NetX Duo, the networking support module for the ThreadX real-time operating system. The flaw resides in the _nx_ip_packet_receive() function and affects versions prior to 6.4.4. The function fails to validate packet contents when an incoming Ethernet frame declares an IP EtherType but contains no IP payload data. A remote attacker on the network can send a crafted Ethernet frame to trigger the read past the intended buffer boundary [CWE-125]. NetX Duo is widely deployed in embedded devices, IoT gateways, and industrial control systems that rely on the ThreadX RTOS.

Critical Impact
A network-adjacent attacker can send a malformed Ethernet frame declaring an IP EtherType with no IP data, forcing the IP receive routine to read out of bounds and potentially disclose memory contents or destabilize embedded devices running NetX Duo.

Affected Products

Eclipse ThreadX NetX Duo versions prior to 6.4.4
Embedded systems and IoT devices using the ThreadX RTOS networking stack
Industrial control and edge devices bundling NetX Duo for TCP/IP connectivity

Discovery Timeline

2025-10-16 - CVE-2025-55091 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55091

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] inside _nx_ip_packet_receive(), the function that dispatches inbound IP packets after the Ethernet driver hands them up the stack. NetX Duo inspects the Ethernet EtherType field to decide how to parse the payload. When the EtherType indicates IPv4 or IPv6, the function proceeds to read IP header fields from the packet buffer.

If the frame carries the IP EtherType but no IP data follows the Ethernet header, the function reads beyond the end of the received buffer. The routine dereferences memory that was never populated by the network driver. The attacker triggers the condition remotely by transmitting a single crafted Ethernet frame to a device on the same link, without authentication or user interaction.

The read can expose adjacent heap or stack memory to subsequent parsing logic and may cause the RTOS to fault. Impact varies by device, but denial of service on constrained embedded targets is the most likely outcome given the stack's role in device connectivity.

Root Cause

The root cause is missing length validation. _nx_ip_packet_receive() trusts that any frame carrying an IP EtherType contains at least a full IP header. The function does not confirm that the packet length exceeds the Ethernet header size before dereferencing IP header fields. A zero-length or truncated IP payload passes the EtherType check and reaches parsing code that assumes valid IP data is present.

Attack Vector

Exploitation requires network access to the target device and the ability to place a crafted Ethernet frame on the same broadcast domain. The attacker sets the EtherType to 0x0800 (IPv4) or 0x86DD (IPv6) and omits the IP payload. No credentials, prior compromise, or user action are required. Devices bridging the NetX Duo stack to untrusted network segments are directly exposed.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-55091

Indicators of Compromise

Ethernet frames with IPv4 (0x0800) or IPv6 (0x86DD) EtherType and payload length below the minimum IP header size (20 bytes for IPv4, 40 bytes for IPv6)
Unexpected reboots, watchdog resets, or crash logs on ThreadX-based devices coinciding with inbound network activity
Repeated malformed frames originating from a single MAC address on an operational technology or IoT segment

Detection Strategies

Deploy network intrusion detection signatures that flag Ethernet frames declaring an IP EtherType with truncated or empty payloads
Inspect switch port counters and span traffic destined for ThreadX-based devices for undersized IP frames
Correlate device fault telemetry with packet capture data at the network edge to identify triggering frames

Monitoring Recommendations

Enable syslog forwarding from embedded devices to a central data lake for crash and reset event correlation
Baseline normal Ethernet frame size distributions per device class and alert on anomalous undersized IP frames
Monitor OT and IoT VLANs for unauthorized hosts capable of crafting raw Ethernet frames

How to Mitigate CVE-2025-55091

Immediate Actions Required

Inventory all firmware and devices that embed Eclipse ThreadX NetX Duo and identify versions prior to 6.4.4
Upgrade affected devices to NetX Duo 6.4.4 or later through the device vendor's firmware update process
Restrict layer-2 access to affected devices using VLAN segmentation and port-based access control

Patch Information

Eclipse Foundation addressed the vulnerability in NetX Duo 6.4.4. The fix adds length validation in _nx_ip_packet_receive() before parsing IP header fields. Refer to the GitHub Security Advisory GHSA-pf5q-r6q5-6j2f for the authoritative advisory and patch references. Device manufacturers must rebuild firmware against the patched version and distribute updated images to end users.

Workarounds

Where firmware updates are not immediately available, isolate ThreadX-based devices on dedicated network segments accessible only to trusted hosts
Configure upstream switches or firewalls to drop malformed or undersized Ethernet frames destined for embedded targets
Disable unused network interfaces on affected devices to reduce exposure to attacker-controlled links

bash

# Example: block undersized IPv4 frames on a Linux bridge protecting ThreadX devices
# Drop IPv4 frames smaller than Ethernet header (14) + IPv4 header (20) = 34 bytes
ebtables -A FORWARD -p IPv4 --pkttype-type multicast -j ACCEPT
ebtables -A FORWARD -p IPv4 -o eth-thredx0 \
  --among-src-file /etc/trusted-macs \
  -j ACCEPT
ebtables -A FORWARD -p IPv4 -o eth-thredx0 -j DROP