PT-2025-15119 · Eclipse · Eclipse Threadx Netx Duo

Kelly Patterson · Published 2025-04-06 · Updated 2025-04-06 · CVE-2025-2259

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Eclipse ThreadX NetX Duo versions prior to 6.4.3

Description The issue is related to the NetX HTTP server functionality, where an attacker can cause an integer underflow and a subsequent denial of service. This can be achieved by writing a very large file or by sending specially crafted packets with a Content-Length smaller than the data request size.

Recommendations For versions prior to 6.4.3, consider disabling HTTP PUT support as a temporary workaround to mitigate the risk of exploitation. Update to version 6.4.3 or later to resolve the issue.

Fix

DoS

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2025-2259

GHSA-CHHP-GMXC-46RQ

Affected Products

Eclipse Threadx Netx Duo

References · 8

• https://github.com/eclipse-threadx/netxduo/commit/fb3195bbb6d0d6fe71a7a19585c008623c217f9e · Patch
• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-chhp-gmxc-46rq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2259 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2259 · Vendor Advisory
• https://t.me/cvetracker/20928 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2024-2104 · Note
• https://t.me/cvedetector/22229 · Telegram Post
• https://twitter.com/CVEnew/status/1908963945206993206 · Twitter Post