CVE-2025-55087 Details
Description
In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by a crafted SNMPv3 security parameters.
A vulnerability allowing out-of-bounds read has been identified in NextX Duo's SNMP addon, affecting versions through 6.4.3. This issue arises from the SNMPv3 security parameters being parsed without proper length checks, enabling attackers to craft requests that exploit this oversight. The vulnerability is rooted in the `_nx_snmp_version_3_process` function within `nxd_snmp.c`, where the absence of buffer length validation before accessing the security parameters can lead to reading memory outside the allocated buffer, particularly when the buffer length is short.
Users can upgrade to NetX Duo version 6.4.4 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-v474-mv4g-v8cx | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| eclipse threadx netx duo | < 6.4.4.202503 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2025 | Initial Analysis | [email protected] |
| Oct 17, 2025 | New CVE Received | [email protected] |