CVE-2025-2260
📋 TL;DR
This vulnerability in Eclipse ThreadX NetX Duo's HTTP server allows attackers to cause denial of service through specially crafted packets. The issue stems from missing file closure during error conditions, causing 404 errors for subsequent file requests. Systems using NetX Duo HTTP server with PUT request support enabled are affected.
💻 Affected Systems
- Eclipse ThreadX NetX Duo
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete HTTP service disruption for all file requests after exploitation, requiring service restart to recover functionality.
Likely Case
HTTP server becomes unresponsive to file requests, affecting web services and applications relying on the HTTP server functionality.
If Mitigated
Minimal impact if PUT requests are disabled or the system is patched, with normal HTTP operations continuing uninterrupted.
🎯 Exploit Status
Exploitation requires sending specially crafted packets to the HTTP server, which is straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.3
Vendor Advisory: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-f42f-6fvv-xqx3
Restart Required: Yes
Instructions:
1. Update NetX Duo to version 6.4.3 or later. 2. Rebuild and redeploy applications using NetX Duo. 3. Restart affected services.
🔧 Temporary Workarounds
Disable PUT Request Support
allDisable HTTP PUT method support in NetX Duo configuration to prevent exploitation.
Modify NetX Duo configuration to set NX_DISABLE_PUT_REQUEST=1 or equivalent
🧯 If You Can't Patch
- Disable HTTP PUT request support in configuration
- Implement network filtering to block malicious HTTP packets targeting the server
🔍 How to Verify
Check if Vulnerable:
Check NetX Duo version: if below 6.4.3 and HTTP server with PUT support is enabled, system is vulnerable.Check Version:
Check application build configuration or source code for NX_VERSION defineVerify Fix Applied:
Verify NetX Duo version is 6.4.3 or higher and test HTTP file requests after sending error-triggering packets.📡 Detection & Monitoring
Log Indicators:
- Sudden increase in 404 errors for valid file requests
- HTTP server error logs showing file handle exhaustion
Network Indicators:
- Unusual HTTP PUT requests followed by 404 responses for GET requests
- HTTP service becoming unresponsive to file requests
SIEM Query:
source="http_server" (status=404) AND (method=GET) | stats count by src_ip