PT-2025-42315 · Eclipse Foundation · Eclipse Nextx Duo

Justin-Stauffer · Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-55081

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Foundation NextX Duo versions prior to 6.4.4

Description The nx secure tls process clienthello() function lacked proper length verification for the ciphersuite length and compression method length within SSL/TLS client hello messages. An attacker could craft a message with values outside the expected range, potentially leading to an out-of-bound read. The vulnerable function is nx secure tls process clienthello().

Recommendations Update to version 6.4.4 or later.

Fix

Buffer Over-read

Out of bounds Read

Weakness Enumeration

CWE-126

CWE-125

Related Identifiers

CVE-2025-55081

GHSA-5VRV-8J5H-H6H6

Affected Products

Eclipse Nextx Duo

References · 5

• https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-5vrv-8j5h-h6h6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55081 · Security Note
• https://twitter.com/CVEnew/status/1978545101690621961 · Twitter Post
• https://t.me/CVEtracker/34992 · Telegram Post