CVE-2025-55081: falha de média gravidade em Eclipse Foundation NetX Duo
Potential out of bound read in _nx_secure_tls_process_clienthello()
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.4%
In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of
certain SSL/TLS client hello message: the ciphersuite length and
compression method length. In case of an attacker-crafted message with
values outside of the expected range, it could cause an out-of-bound
read.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Eclipse Foundation · NetX DuoCVEs relacionadas — Eclipse Foundation NetX Duo
No mesmo produto, das mais perigosas para as menos.
CVE-2025-55085HIGHWeb http client: Unchecked Server-Side Malicious Packet IssueEPSS 0.6%CVE-2025-55094MEDIUMPotential out-of-bounds read in _nx_icmpv6_validate_options()EPSS 0.4%CVE-2025-55091MEDIUMPotential out of bound read in _nx_ip_packet_receive()EPSS 0.4%CVE-2025-55090MEDIUMPotential out of bound read issue in _nx_ipv4_packet_receive() in NetX DuoEPSS 0.4%CVE-2025-55092MEDIUMPotential out of bound read in _nx_ipv4_option_process()EPSS 0.3%CVE-2025-55084MEDIUMOut of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()EPSS 0.3%