CVE-2025-55086: medium-severity vulnerability in Eclipse Foundation NextX Duo
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
NetXDuo's DHCPv6 client doesn't properly validate data from DHCP server responses, allowing an attacker to craft a malicious packet that reads memory beyond what should be accessible. This could expose sensitive information or crash the system.
CWE-125 (out-of-bounds read) in NetXDuo DHCPv6 client: unchecked index when extracting server DUID from reply packets enables remote memory disclosure. Attack vector is network-based (crafted DHCP reply); requires attacker to intercept or spoof DHCP responses. Impact includes information disclosure and potential denial of service.
In the same product, most dangerous first.