CVE-2025-55092 Overview
CVE-2025-55092 is an out-of-bounds read vulnerability in Eclipse Foundation NetX Duo, the networking support module for Eclipse ThreadX. The flaw resides in the _nx_ipv4_option_process() function, which mishandles IPv4 packets containing the timestamp option. A remote attacker can send a crafted IPv4 packet to trigger the read past a valid memory boundary. The issue affects NetX Duo versions before 6.4.4 and is classified under CWE-125. NetX Duo is widely deployed in embedded and Internet of Things (IoT) devices running the ThreadX real-time operating system (RTOS).
Critical Impact
A network-adjacent attacker can trigger an out-of-bounds read in the IPv4 stack of ThreadX-based devices, potentially leaking memory contents or causing device instability.
Affected Products
- Eclipse Foundation NetX Duo versions before 6.4.4
- Eclipse ThreadX deployments using the NetX Duo networking module
- Embedded and IoT devices bundling vulnerable NetX Duo releases
Discovery Timeline
- 2025-10-17 - CVE-2025-55092 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55092
Vulnerability Analysis
The vulnerability exists in _nx_ipv4_option_process(), the routine that parses IPv4 header options during packet ingestion. When the function encounters a timestamp option, it fails to properly validate the option length against the remaining bytes in the IPv4 header. This allows the parser to read beyond the intended boundary of the option buffer.
Out-of-bounds reads in a networking stack can disclose adjacent memory contents or produce inconsistent internal state. In embedded RTOS environments like ThreadX, memory is often flat and shared across tasks, which increases the sensitivity of any unbounded read. The Common Weakness Enumeration classifies this as CWE-125: Out-of-bounds Read.
Root Cause
The root cause is missing bounds validation on the length field of the IPv4 timestamp option. The parser trusts attacker-controlled length values without confirming they fit within the declared IP header length. As a result, subsequent field accesses reference memory past the option buffer.
Attack Vector
Exploitation requires only the ability to send an IPv4 packet to the affected device. No authentication or user interaction is required. An attacker on the same network segment, or any network path that reaches the device, can craft an IPv4 packet with a malformed timestamp option and deliver it to trigger the condition. The impact is limited to confidentiality of the read memory region, with no direct integrity or availability effect indicated by the vendor.
No verified proof-of-concept code is publicly available. Refer to the Eclipse NetX Duo GitHub Security Advisory (GHSA-vwh7-h99r-fvwq) for authoritative technical details.
Detection Methods for CVE-2025-55092
Indicators of Compromise
- Inbound IPv4 packets containing the timestamp option (option type 68) with malformed or oversized length fields
- Unexpected reboots, watchdog resets, or task faults on ThreadX-based devices coinciding with network traffic bursts
- Anomalous ICMP or protocol responses from embedded devices following receipt of crafted IPv4 packets
Detection Strategies
- Deploy network intrusion detection signatures that flag IPv4 packets with the timestamp option and inconsistent internal length values
- Inspect packet captures at network chokepoints for IPv4 headers where option length exceeds the header length boundary
- Inventory devices running Eclipse ThreadX and cross-reference NetX Duo versions against the 6.4.4 patch baseline
Monitoring Recommendations
- Enable telemetry from IoT and operational technology (OT) gateways to capture protocol anomalies targeting embedded stacks
- Monitor for reconnaissance patterns that enumerate IPv4-only embedded endpoints on management VLANs
- Correlate device crash logs and syslog output with upstream firewall events involving IPv4 options
How to Mitigate CVE-2025-55092
Immediate Actions Required
- Upgrade Eclipse NetX Duo to version 6.4.4 or later across all firmware images that ship the networking module
- Identify all embedded and IoT products in the environment that integrate NetX Duo and coordinate patch rollout with vendors
- Restrict inbound IPv4 traffic to ThreadX-based devices through segmentation and access control lists
Patch Information
The Eclipse Foundation addressed the issue in NetX Duo 6.4.4. Details and patch references are published in the GitHub Security Advisory GHSA-vwh7-h99r-fvwq. Downstream product vendors that embed NetX Duo must rebuild and redistribute firmware to deliver the fix to end devices.
Workarounds
- Drop or strip IPv4 packets containing header options at perimeter firewalls where the option is not required by the application
- Place ThreadX-based devices on isolated network segments accessible only to trusted management systems
- Rate-limit and filter IPv4 traffic to embedded endpoints until firmware updates are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
