CVE-2025-55082
📋 TL;DR
This vulnerability in NetX Duo's TLS implementation allows attackers to cause an out-of-bounds read by providing malformed PSK length in ClientHello messages. It affects systems using NetX Duo versions before 6.4.4 for TLS connections. The vulnerability could lead to information disclosure or denial of service.
💻 Affected Systems
- Eclipse ThreadX NetX Duo
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution or complete system compromise through memory corruption leading to arbitrary code execution.
Likely Case
Denial of service through application crash or information disclosure of adjacent memory contents.
If Mitigated
Minimal impact if proper input validation and memory protections are in place.
🎯 Exploit Status
Requires ability to send crafted TLS ClientHello messages to vulnerable TLS servers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.4
Vendor Advisory: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-8h38-qjhh-mf2h
Restart Required: No
Instructions:
1. Update NetX Duo library to version 6.4.4 or later. 2. Recompile and redeploy applications using the updated library. 3. No service restart required for library update alone.
🔧 Temporary Workarounds
Disable PSK Authentication
allDisable Pre-Shared Key authentication in TLS configuration if not required.
# Configure TLS to disable PSK: NX_SECURE_TLS_PSK_ENABLED=0
🧯 If You Can't Patch
- Implement network filtering to block malicious TLS handshake patterns
- Use application firewalls to inspect and validate TLS handshake messages
🔍 How to Verify
Check if Vulnerable:
Check NetX Duo library version in your application build configuration or source code.Check Version:
# Check NetX Duo version in source: grep -r "NX_DUO_VERSION" source_code/Verify Fix Applied:
Verify NetX Duo version is 6.4.4 or later in your application build.📡 Detection & Monitoring
Log Indicators:
- Application crashes during TLS handshake
- Memory access violation errors in logs
Network Indicators:
- Abnormal TLS ClientHello messages with malformed PSK extensions
SIEM Query:
event.category:network AND tls.handshake.type:client_hello AND (pskextension.length:>2048 OR pskextension.length:<0)