CVE-2025-55093 Overview
CVE-2025-55093 is an out-of-bounds read vulnerability in Eclipse ThreadX NetX Duo, the networking support module for the Eclipse Foundation ThreadX real-time operating system. The flaw resides in the _nx_ipv4_packet_receive() function when it processes unicast Dynamic Host Configuration Protocol (DHCP) messages. Attackers can trigger corruption of 4 bytes of memory by sending crafted network packets. The vulnerability affects NetX Duo versions before 6.4.4 and is tracked under [CWE-125] and [CWE-126]. The issue is network-exploitable and requires no authentication or user interaction.
Critical Impact
A remote attacker on the network can trigger an out-of-bounds read in the IPv4 packet receive path, corrupting 4 bytes of memory on ThreadX-based devices processing unicast DHCP traffic.
Affected Products
- Eclipse ThreadX NetX Duo versions before 6.4.4
- Embedded systems and IoT devices running ThreadX with NetX Duo networking
- Devices processing unicast DHCP messages through _nx_ipv4_packet_receive()
Discovery Timeline
- 2025-10-17 - CVE-2025-55093 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55093
Vulnerability Analysis
The vulnerability exists in the _nx_ipv4_packet_receive() function within NetX Duo, which handles incoming IPv4 packets on ThreadX-based systems. When the function processes unicast DHCP messages, it performs a read operation that extends beyond the allocated buffer boundary. This out-of-bounds read leads to corruption of 4 bytes of memory during packet processing.
The issue is classified under both [CWE-125] (Out-of-Bounds Read) and [CWE-126] (Buffer Over-read). NetX Duo is widely embedded in industrial controllers, medical devices, and IoT products, making the attack surface broad. The EPSS score is 0.29%, indicating a low but non-zero probability of exploitation in the near term.
Root Cause
The root cause is insufficient bounds validation in _nx_ipv4_packet_receive() when parsing unicast DHCP payloads. The function reads packet fields without verifying that the referenced offsets remain within the declared packet length. Malformed or crafted DHCP messages cause the parser to dereference memory outside the intended packet buffer, resulting in the 4-byte memory corruption.
Attack Vector
An unauthenticated attacker on the same network segment can send a crafted unicast DHCP message to a vulnerable ThreadX device. Because DHCP is commonly enabled on embedded and IoT endpoints, the attacker only needs network reachability to the target's IPv4 stack. No user interaction or prior authentication is required. Successful exploitation corrupts 4 bytes of memory, which can affect device state or availability depending on the memory region touched.
See the Eclipse NetX Duo GHSA-c9pq-93jp-w649 advisory for technical details.
Detection Methods for CVE-2025-55093
Indicators of Compromise
- Unexpected reboots or crashes on ThreadX devices coinciding with DHCP traffic on the segment
- Malformed unicast DHCP packets targeting embedded devices, particularly with anomalous option field lengths
- Firmware versions of NetX Duo prior to 6.4.4 identified via asset inventory
Detection Strategies
- Inspect DHCP traffic at network chokepoints for malformed unicast DHCP messages with inconsistent length fields
- Compare deployed NetX Duo versions against the fixed release (6.4.4) using firmware and software bill of materials (SBOM) data
- Alert on abnormal restarts or watchdog resets on embedded devices correlated with inbound DHCP activity
Monitoring Recommendations
- Enable IDS/IPS signatures covering malformed DHCP option parsing on network segments containing ThreadX devices
- Log and review all unicast DHCP traffic destined for embedded endpoints where broadcast DHCP is expected
- Monitor device telemetry for memory faults, exception handlers firing, or unexpected network stack restarts
How to Mitigate CVE-2025-55093
Immediate Actions Required
- Identify all deployed devices and firmware images using Eclipse ThreadX NetX Duo prior to version 6.4.4
- Upgrade affected devices to NetX Duo 6.4.4 or later where vendor firmware updates are available
- Restrict DHCP traffic on sensitive network segments to trusted DHCP servers using DHCP snooping
Patch Information
Eclipse has addressed the vulnerability in NetX Duo version 6.4.4. Device manufacturers integrating NetX Duo should rebuild firmware against the patched source and distribute updated images to affected products. Refer to the Eclipse ThreadX NetX Duo Security Advisory GHSA-c9pq-93jp-w649 for release information.
Workarounds
- Segment ThreadX and IoT devices onto isolated VLANs with strict Layer 2 filtering
- Enable DHCP snooping on managed switches to block rogue or malformed DHCP messages
- Where DHCP is not required, disable the DHCP client on affected devices and use static addressing
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
