Medium severity · published Oct 15, 2025
CVE-2025-55083
Broken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check resulting it out by two out of bound read.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ND
NetX Duo · Eclipse Foundation
before 6.4.4 · source: vendor
TN
Threadx Netx Duo · Eclipse
before 6.4.4.202503 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55083
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55083
Vendor Advisory
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9hw5-4xcv-jprm
More from NetX Duo
9.3
CVE-2026-103415
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet
9.3
CVE-2026-102761
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the…
9.1
CVE-2025-55081
Potential out of bound read in _nx_secure_tls_process_clienthello()
8.8
CVE-2026-102713
The TFTP server accepts a DATA datagram of any size
8.8
CVE-2026-102712
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the…