CVE-2025-55081 is a critical out-of-bounds read in NetX Duo, the networking module of Eclipse ThreadX. The function that processes a TLS client hello does not verify the ciphersuite length and compression method length. Versions before 6.4.4 are affected, and 6.4.4 contains the fix.
What's affected
- Product: NetX Duo, the networking support module for Eclipse Foundation ThreadX (the
_nx_secure_tls_process_clienthello()function). - Affected: versions up to and including 6.4.3, per the GitHub advisory.
- Fixed: 6.4.4.
- Trigger: a crafted TLS client hello with length values outside the expected range. This matters for devices that act as a TLS server.
Two scores exist. NVD rates the issue 9.1 critical. The GitHub advisory rates it moderate, 6.9 on CVSS 4.0, with low confidentiality impact only. The sources therefore disagree on how severe it is. The vendor's own description supports a read of memory outside a buffer, with the effect depending on what the device keeps there.
Because the fix is in a library you compile, a fixed upstream release does nothing until your firmware is rebuilt and shipped to devices.
How to check if you're exposed
ThreadX modules are usually compiled into firmware, so there is no package manager to ask. Work from your build.
git submodule status
git -C path/to/module describe --tags
Run these in the repository that vendors the module, and substitute the real path. If your firmware comes from a chip vendor SDK, the SDK may carry its own copy of the module, so check the SDK release notes and ask the vendor which module version it ships. Your firmware bill of materials, if you keep one, is the quickest place to answer the question for a whole product line.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that checks a manifest or lockfile against known vulnerabilities, and the Gold directory lists affected packages for each CVE.
What to do now
- Find every product that includes NetX Duo, and the version each one uses.
- Update the module to 6.4.4 or later, rebuild, test and release a firmware update.
- If you receive firmware from a supplier, ask them for a statement on this CVE and the date of a fixed build.
- Where updates take time, limit which networks can reach the device's TLS port, and keep devices off the public internet.
- Add the module and version to your firmware bill of materials, so the next advisory is a lookup instead of a search.
Why it matters
The listed weaknesses are out-of-bounds read and buffer over-read. A parser trusted two length fields from the network without checking them against the actual message size, and so read memory it should not touch. The classic remedy is to validate each length against the remaining bytes before using it.
An over-read in a TLS handshake parser is reachable before any authentication, because the handshake comes first. That puts the bug at the front door of any device that accepts TLS connections. This is an embedded component, which means the practical risk depends on whether the affected feature is compiled in and reachable on a given device. It is not on the CISA KEV list.
The weakness is classed as CWE-125 (Out-of-bounds Read) and CWE-126 (Buffer Over-read). Severity in the CVE record: critical, CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Quick check
Which version fixes it?
NetX Duo 6.4.4. The advisory lists versions up to 6.4.3 as affected.
Why do the severity ratings differ?
NVD rates it 9.1 critical, and the GitHub advisory rates it moderate at 6.9 on CVSS 4.0. Use your device's exposure to decide urgency.
Sources
Last reviewed: 18 October 2026.
