PT-2025-42611 · Eclipse Foundation+1 · Eclipse Foundation Threadx+1

Ekleezg · Published 2025-10-17 · Updated 2025-10-17 · CVE-2025-55085

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NextX Duo versions prior to 6.4.4

Description The HTTP client module in NextX Duo does not properly validate the boundaries when parsing HTTP header fields. This missing bounds verification could lead to undefined behavior if a server sends a specially crafted response. The issue resides within the network support code for Eclipse Foundation ThreadX.

Recommendations Update NextX Duo to version 6.4.4 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

CWE-1286

Related Identifiers

CVE-2025-55085

GHSA-9C77-RGP9-C2G2

Affected Products

Eclipse Foundation Threadx

Netx Duo

References · 7

• 🔥 https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9c77-rgp9-c2g2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55085 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55085 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1979212760777941044 · Twitter Post
• https://twitter.com/CveFindCom/status/1979195604828852690 · Twitter Post
• https://t.me/CVEtracker/35190 · Telegram Post
• https://twitter.com/CVEnew/status/1979204792024207382 · Twitter Post