CVE-2025-55086 is a critical out-of-bounds read in the DHCPv6 client of NetX Duo, the networking module for Eclipse ThreadX. An unchecked index is used when extracting the server DUID from a reply. Versions before 6.4.4 are affected, and 6.4.4 contains the fix.
What's affected
- Product: NetX Duo, the networking support module for Eclipse Foundation ThreadX.
- Component: the DHCPv6 client, function
_nx_dhcpv6_process_server_duidinnxd_dhcpv6_client.c. - Affected: versions up to and including 6.4.3.
- Fixed: 6.4.4.
The advisory explains that the client reads the server DUID by walking through the reply and adjusting an index, and that one parsing path lacks a check of the index position against the message length. A crafted reply can therefore cause an out-of-bounds memory read.
Only firmware that has the DHCPv6 client compiled in and enabled is exposed. IPv4-only devices, or builds that leave DHCPv6 out, do not run this code path.
How to check if you're exposed
ThreadX modules are usually compiled into firmware, so there is no package manager to ask. Work from your build.
git submodule status
git -C path/to/module describe --tags
Run these in the repository that vendors the module, and substitute the real path. If your firmware comes from a chip vendor SDK, the SDK may carry its own copy of the module, so check the SDK release notes and ask the vendor which module version it ships. Your firmware bill of materials, if you keep one, is the quickest place to answer the question for a whole product line.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that checks a manifest or lockfile against known vulnerabilities, and the Gold directory lists affected packages for each CVE.
Also check your build configuration for the DHCPv6 client. If the feature is not compiled in, the vulnerable function is absent from the image.
What to do now
- Identify products that use NetX Duo and whether the DHCPv6 client is enabled in each build.
- Update the module to 6.4.4 or later, rebuild and test.
- Ship the firmware update through your normal release channel, prioritizing devices on networks where an untrusted party could answer DHCPv6 requests.
- Where DHCPv6 is not needed, disable it in the build, or use static addressing.
- Segment device networks so only trusted DHCPv6 servers can reach them.
Why it matters
The record lists out-of-bounds read and improper validation of an index or offset. The client walked a variable length message and trusted that the next field began where its arithmetic said it did. One missed bounds check on one path is enough.
The attack surface is the local network, since DHCP replies come from the same link. The CVSS vector is nonetheless rated network accessible with no privileges and no user interaction, which is why the score is 9.8. In a flat network where any host can answer a DHCP request, the practical barrier is low. This is an embedded component, which means the practical risk depends on whether the affected feature is compiled in and reachable on a given device. It is not on the CISA KEV list.
The weakness is classed as CWE-125 (Out-of-bounds Read) and CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input). Severity in the CVE record: critical, CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Quick check
Does it matter if I do not use DHCPv6?
If the DHCPv6 client is not compiled into your firmware, the vulnerable code is not present. Check your build configuration to be sure.
Which version fixes it?
NetX Duo 6.4.4. The advisory lists versions up to 6.4.3 as affected.
Sources
Last reviewed: 18 October 2026.
