High severity · published Oct 17, 2025
CVE-2025-55085
Web http client: Unchecked Server-Side Malicious Packet Issue
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ND
NetX Duo · Eclipse Foundation
before 6.4.4 · source: vendor
TN
Threadx Netx Duo · Eclipse
before 6.4.4.202503 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55085
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55085
Exploit
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9c77-rgp9-c2g2
More from NetX Duo
9.3
CVE-2026-103415
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet
9.3
CVE-2026-102761
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the…
9.1
CVE-2025-55081
Potential out of bound read in _nx_secure_tls_process_clienthello()
8.8
CVE-2026-102713
The TFTP server accepts a DATA datagram of any size
8.8
CVE-2026-102712
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the…