PT-2025-15118 · Eclipse · Eclipse Threadx Netx Duo

Kelly Patterson · Published 2025-04-06 · Updated 2025-04-06 · CVE-2025-2258

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Eclipse ThreadX NetX Duo versions prior to 6.4.3

Description The issue is related to the HTTP server functionality in the NetX Duo component, where an attacker can cause an integer underflow and a subsequent denial of service. This can be achieved by writing a very large file or by sending specially crafted packets with a Content-Length smaller than the data request size.

Recommendations For versions prior to 6.4.3, update to version 6.4.3 or later to resolve the issue. As a temporary workaround, consider disabling HTTP PUT support until a patch is available.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2025-2258

GHSA-CHQP-8VF8-CJ25

Affected Products

Eclipse Threadx Netx Duo

References · 8

• https://github.com/eclipse-threadx/netxduo/commit/6c8e9d1c95d71bd4b313e1cc37d8f8841543b248 · Patch
• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-chqp-8vf8-cj25 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2258 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2258 · Vendor Advisory
• https://t.me/cvedetector/22231 · Telegram Post
• https://t.me/cvetracker/20927 · Telegram Post
• https://twitter.com/CVEnew/status/1908963946935070868 · Twitter Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2024-2105 · Note