CVE-2025-55091

The `_nx_snmp_utility_object_id_get` function in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. The OOB bytes are decoded as OID component values and written into the agent's internal OID string buffer, corrupting agent state. On systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. On bare metal embedded systems without memory protection the read silently succeeds and corrupts the agent's internal state with heap data.

NetX Duo's WebSocket client resets the unmasking cursor to the first NX_PACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets drives the XOR loop through the first packet's unused payload area and on through the second packet's NX_PACKET control block. The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbound network traffic on the device until it is rebooted.

In NetX Duo before version 6.4.4, the networking support module for Eclipse Foundation ThreadX, there is a potential out-of-bounds read issue in _nx_icmpv6_validate_options() when handling a packet with ICMP6 options.

In NetX Duo before version 6.4.4, the networking module for Eclipse Foundation ThreadX, there is a potential out-of-bounds read issue in _nx_ipv4_packet_receive() when handling unicast DHCP messages, which could cause corruption of 4 bytes of memory.

In NetX Duo before version 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out-of-bounds read issue in the _nx_ipv4_packet_receive() function when receiving an Ethernet frame with less than 4 bytes of IP packet.

In NetX Duo versions before 6.4.4 (Eclipse Foundation ThreadX component), there is an incorrect bound check in _nx_secure_tls_proc_clienthello_supported_versions_extension() in the extension version field.

In NetX Duo before version 6.4.4, a component of Eclipse Foundation ThreadX, there is an incorrect bound check resulting in an out-of-bounds read by two bytes.

In NetX Duo before version 6.4.4, a component of Eclipse Foundation ThreadX, there is a potential out-of-bounds read in _nx_secure_tls_process_clienthello() due to missing validation of PSK length provided in the user message.