CVE-2025-55084CWE-126

CVE-2025-55084

Medium · published October 16, 2025

CVSS v3.1

5.3

EPSS

Percentile

24.9

In the wild

Unconfirmed

What it is

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_versions_extension() in the extension version field.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00331 · 24.9th percentile
Weakness: CWE-126 · Buffer Over-read
Published: 2025-10-16T11:15Z

Affected products (1)

Product	Versions	Fixed in
eclipse/threadx_netx_duo	< 6.4.4.202503	6.4.4.202503

References (1)

https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-m474-39rw-v8gm · [email protected]

EPSS history

Timeline

16 OCT 06:29Z
Out of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()
cvelistv5