CVE-2025-55082
BaseFortify
Publication date: 2025-10-15
Last updated on: 2025-10-21
Assigner: Eclipse Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| eclipse | threadx_netx_duo | to 6.4.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-55082 is an out-of-bounds read vulnerability in NetX Duo versions before 6.4.4, specifically in the TLS component. The issue occurs because the function that compares a client-provided pre-shared key (PSK) identity with stored identities uses the length provided by the client without validating it first. This can cause the function to read beyond the intended memory bounds, potentially leaking adjacent memory contents. This flaw can be exploited by an attacker to disclose sensitive information byte-by-byte from memory. [1]
How can this vulnerability impact me? :
This vulnerability can lead to information disclosure by allowing an attacker to read memory beyond the intended buffer, potentially leaking sensitive data such as cryptographic keys stored nearby in memory. The attack can be performed remotely over the network without any privileges or user interaction. The impact is limited to confidentiality loss, with no effect on integrity or availability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for TLS client hello messages with anomalous or unusually large PSK identity lengths that could trigger the out-of-bounds read. Since the vulnerability is in the NetX Duo TLS stack, detection may involve capturing and analyzing TLS handshake messages to identify suspicious PSK identity lengths. Specific commands could include using packet capture tools such as 'tcpdump' or 'Wireshark' to filter TLS client hello messages and inspect PSK identity lengths. For example, using tcpdump: 'tcpdump -i <interface> -w capture.pcap port 443' followed by analysis in Wireshark to examine the PSK identity fields in TLS client hello messages. However, no direct detection commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade NetX Duo to version 6.4.4 or later, where this vulnerability has been patched. Avoid using vulnerable versions (prior to 6.4.4). Additionally, if upgrading is not immediately possible, consider restricting or monitoring network access to the affected service to reduce exposure to potentially malicious TLS client hello messages with crafted PSK identities. [1]