CVE-2025-0728
📋 TL;DR
An integer underflow vulnerability in NetX HTTP server functionality of Eclipse ThreadX NetX Duo allows attackers to cause denial of service by sending specially crafted HTTP packets with mismatched Content-Length and data size. This affects systems using NetX Duo HTTP server with PUT support enabled before version 6.4.2.
💻 Affected Systems
- Eclipse ThreadX NetX Duo
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for the HTTP server component, potentially crashing the service or causing resource exhaustion on embedded systems.
Likely Case
HTTP server becomes unresponsive or crashes, disrupting web services on affected devices.
If Mitigated
Minimal impact if PUT support is disabled or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires crafting specific HTTP packets but no authentication is needed; attacker needs network access to HTTP server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.2
Vendor Advisory: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-hqp7-4q26-6wqf
Restart Required: No
Instructions:
1. Update NetX Duo library to version 6.4.2 or later. 2. Recompile and redeploy affected applications. 3. Verify HTTP PUT functionality works correctly after update.
🔧 Temporary Workarounds
Disable HTTP PUT Support
allDisable HTTP PUT method in NetX Duo HTTP server configuration to prevent exploitation.
Modify HTTP server configuration to disable PUT method (specific implementation varies by system)
🧯 If You Can't Patch
- Disable HTTP PUT functionality in server configuration.
- Implement network filtering to block or monitor HTTP PUT requests to vulnerable systems.
🔍 How to Verify
Check if Vulnerable:
Check NetX Duo library version; if below 6.4.2 and HTTP PUT is enabled, system is vulnerable.Check Version:
Check build configuration or source code for NX_DUO_VERSION; should be >= 0x00060402Verify Fix Applied:
Verify NetX Duo version is 6.4.2 or later and test HTTP PUT functionality with malformed requests.📡 Detection & Monitoring
Log Indicators:
- HTTP server crash logs
- Unusual HTTP PUT requests with mismatched Content-Length headers
- Resource exhaustion warnings
Network Indicators:
- HTTP PUT requests with Content-Length smaller than actual data size
- Multiple failed HTTP requests to same endpoint
SIEM Query:
http.method:PUT AND (http.content_length < content_size_estimate) OR http.server contains "NetX"