CVE-2025-55094: Eclipse ThreadX NetX Duo Buffer Overflow

CVE-2025-55094 Overview

CVE-2025-55094 is an out-of-bounds read vulnerability affecting Eclipse Foundation's NetX Duo networking support module for ThreadX. The vulnerability exists in the _nx_icmpv6_validate_options() function, which improperly handles packets containing ICMP6 options. An attacker capable of sending specially crafted network packets could exploit this flaw to read memory beyond the intended bounds, potentially exposing sensitive information.

Critical Impact

This vulnerability allows remote attackers to trigger out-of-bounds memory reads via malformed ICMPv6 packets, potentially leaking sensitive information from embedded systems running ThreadX RTOS with NetX Duo networking stack.

Affected Products

• Eclipse ThreadX NetX Duo versions prior to 6.4.4
• Embedded systems and IoT devices utilizing NetX Duo for IPv6 networking
• Any ThreadX-based application implementing ICMPv6 protocol handling

Discovery Timeline

• 2025-10-17 - CVE-2025-55094 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2025-55094

Vulnerability Analysis

This out-of-bounds read vulnerability (CWE-125) affects the ICMPv6 options validation routine in NetX Duo. The _nx_icmpv6_validate_options() function fails to properly validate the bounds of ICMP6 option data before reading, allowing an attacker to craft packets that cause the function to read beyond allocated buffer boundaries.

The vulnerability is exploitable over the network without requiring authentication or user interaction, making it particularly concerning for IoT and embedded devices that may be directly exposed to network traffic. While the immediate impact is limited to information disclosure rather than code execution, the leaked memory contents could potentially reveal sensitive data or assist in further exploitation of the affected system.

Root Cause

The root cause lies in insufficient bounds checking within the _nx_icmpv6_validate_options() function. When processing ICMPv6 packets with malformed or maliciously crafted options, the function does not adequately verify that option lengths and offsets remain within the packet buffer boundaries before performing read operations. This allows attackers to specify option parameters that cause the function to access memory locations outside the intended packet data area.

Attack Vector

The attack vector is network-based, requiring the attacker to send specially crafted ICMPv6 packets to a vulnerable device. The attack can be executed remotely without authentication, though the attacker must be able to route IPv6 traffic to the target device. Successful exploitation results in memory disclosure from the embedded system's address space, which could include configuration data, cryptographic material, or other sensitive information stored in adjacent memory regions.

The vulnerability is triggered when the target device processes an ICMPv6 packet containing malformed options that specify lengths or offsets beyond the actual packet boundaries. The _nx_icmpv6_validate_options() function processes these options without proper validation, resulting in reads from unintended memory locations.

Detection Methods for CVE-2025-55094

Indicators of Compromise

• Unusual ICMPv6 traffic patterns targeting embedded devices or IoT infrastructure
• Malformed ICMPv6 packets with abnormally large or invalid option lengths
• Network traffic anomalies involving IPv6 Neighbor Discovery or Router Advertisement messages with suspicious option fields
• Evidence of memory disclosure in network packet captures originating from affected devices

Detection Strategies

• Deploy network intrusion detection signatures to identify malformed ICMPv6 packets with invalid option lengths
• Monitor for unusual ICMPv6 traffic volume or patterns directed at ThreadX-based devices
• Implement packet inspection at network boundaries to detect ICMPv6 option field anomalies
• Review firmware versions of deployed NetX Duo implementations to identify vulnerable systems

Monitoring Recommendations

• Enable detailed logging for IPv6 network traffic on network monitoring infrastructure
• Configure SIEM rules to alert on malformed ICMPv6 packets or unusual IPv6 activity patterns
• Establish baselines for normal ICMPv6 traffic and alert on deviations that may indicate exploitation attempts

How to Mitigate CVE-2025-55094

Immediate Actions Required

• Upgrade NetX Duo to version 6.4.4 or later to address the vulnerability
• Review network architecture to limit direct IPv6 exposure of vulnerable embedded devices
• Implement network-level filtering to block malformed ICMPv6 packets at perimeter devices
• Inventory all devices running ThreadX with NetX Duo to assess exposure scope

Patch Information

Eclipse Foundation has released NetX Duo version 6.4.4 which addresses this vulnerability. Organizations should consult the GitHub Security Advisory for detailed patch information and upgrade instructions. Due to the embedded nature of ThreadX deployments, firmware updates may be required for affected devices.

Workarounds

• Implement network segmentation to isolate vulnerable embedded devices from untrusted network segments
• Deploy firewall rules to filter ICMPv6 traffic at network boundaries where possible
• If IPv6 functionality is not required, consider disabling IPv6 on affected devices until patches can be applied
• Use intrusion prevention systems to block known malicious ICMPv6 packet patterns

# Example: Block ICMPv6 at network perimeter (Linux ip6tables)
# Apply to perimeter devices protecting vulnerable embedded systems
ip6tables -A INPUT -p icmpv6 -j DROP
ip6tables -A FORWARD -p icmpv6 -j DROP