High · published October 17, 2025
⚠️ A sneaky out-of-bounds read hides in the networking support module of NetX Duo before version 6.4.4! 🚨 Think of it like a restaurant menu that lets diners peek into the kitchen. An attacker sending a specially crafted packet could access sensitive data they shouldn't be seeing, just like a curious guest snooping around where they don’t belong. If exploited, an attacker could potentially read unauthorized data from memory, compromising the confidentiality of the system. While not devastating, this could lead to sensitive information leaks or unauthorized access to system details, creating a foothold for further attacks.
Think of it like a restaurant menu that lets diners peek into the kitchen. An attacker sending a specially crafted packet could access sensitive data they shouldn't be seeing, just like a curious guest snooping around where they don’t belong. The vulnerability in NetX Duo lies in the _nx_icmpv6_validate_options() function, where improper handling of ICMP6 options can lead to out-of-bounds reads, allowing attackers to access data beyond allocated buffers.
If exploited, an attacker could potentially read unauthorized data from memory, compromising the confidentiality of the system. While not devastating, this could lead to sensitive information leaks or unauthorized access to system details, creating a foothold for further attacks. Update to NetX Duo version 6.4.4 or later to patch this vulnerability. It's also a good practice to review your configurations and potentially audit your network traffic for any unusual activity. You've got this! By following these steps, you'll keep your systems secure and ready to face the challenges ahead. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| eclipse/threadx_netx_duo | < 6.4.4.202503 | 6.4.4.202503 |