The NetX Duo TFTP server lacks an upper bound check on incoming DATA datagrams. An attacker can send a packet larger than the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. The dispatcher accepts the packet, copies its length without bounds checks, and forwards the buffer to FileX, which copies past the end of the first packet and writes bytes beyond the allocated region into the target file. These extraneous bytes are then recoverable to the attacker through a subsequent TFTP read request, exposing memory contents as a data disclosure. Additionally, the same oversized packet causes the server thread to block while waiting for pool resources, leading to a denial‑of‑service state that prevents all further TFTP interactions until the server is restarted. The vulnerability permits remote exploitation over UDP with no authentication required.

The affected product is NetX Duo by the Eclipse Foundation. No specific version information is provided, but the flaw exists in the TFTP module as identified in the netxduo source repository.

The CVSS score of 8.8 indicates high severity, and the vulnerability is publicly reachable via the open network protocol TFTP without credentials. Because EPSS is unavailable, the exploitation probability cannot be quantified precisely, and the data is not listed in CISA’s KEV catalog. Nonetheless, the lack of input validation and the possibility of data disclosure and service interruption make this a critical concern for any systems running unpatched NetX Duo TFTP servers exposed untrusted networks.