Description
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the received packet into the file and read it back by downloading the file, and the same datagram can suspend the server thread permanently.
Published: 2026-09-29
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Data disclosure via memory overrun and denial of service
Action: Immediate Patch
AI Analysis

Impact

The NetX Duo TFTP server, when built with packet chaining, does not bound the length of incoming DATA datagrams. An unauthenticated peer can upload an oversized datagram that writes data beyond the packet into the target file and later read the file to retrieve the overwritten content, leading to data disclosure. The same oversized packet can suspend the server thread permanently, causing a denial‑of‑service. This flaw exists in NetX Duo up to version 6.5.2.202603.

Affected Systems

The affected product is NetX Duo by the Eclipse Foundation. Versions up to and including 6.5.2.202603, built with packet chaining, are vulnerable in the TFTP module as identified in the netxduo source repository.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity, and the vulnerability is publicly reachable via the open network protocol TFTP without credentials. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation. Because the vulnerability is not listed in CISA’s KEV catalog, no evidence of known exploitation is currently documented. Nonetheless, the lack of input validation and possibility of data disclosure and service interruption make this a critical concern for any systems running unpatched NetX Duo TFTP servers exposed to untrusted networks.

Generated by OpenCVE AI on November 4, 2026 at 15:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official NetX Duo patch that fixes the unbounded DATA datagram issue.
  • If a patch is not immediately available, block or filter oversized TFTP DATA packets at the network perimeter or on the host with a firewall rule.
  • Reconfigure or disable the TFTP service if it is not required for operational purposes.

Generated by OpenCVE AI on November 4, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 13:15:00 +0000

Type Values Removed Values Added
Description The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. Two things follow from that one missing check, both reachable before any authentication because TFTP has none. The handler passes `nx_packet_length - 4` straight to FileX: ```c /* addons/tftp/nxd_tftp_server.c:1863, 1889 */ status = nx_packet_copy(packet_ptr, &temp_ptr, server_ptr -> nx_tftp_server_packet_pool_ptr, NX_WAIT_FOREVER); ... fx_file_write(&(client_request_ptr -> nx_tftp_client_request_file), packet_ptr -> nx_packet_prepend_ptr + 4, packet_ptr -> nx_packet_length - 4); ``` `nx_packet_length` is the length of a chain, not of one contiguous buffer, so FileX copies past the end of the first packet: ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1280 at 0x621000001108 thread T5 #0 __interceptor_memcpy #1 _fx_utility_memory_copy filex/common/src/fx_utility_memory_copy.c:78 0x621000001108 is 0 bytes to the right of 4104-byte region ``` Those bytes are written into the file the attacker is uploading, and a TFTP read request hands them back, so this is a memory disclosure with a convenient retrieval channel. The same datagram also wedges the server. `nx_packet_copy` at :1863 needs ceil(nx_packet_length / pool_payload) packets and asks for them with NX_WAIT_FOREVER, so when the attacker sizes the datagram beyond what the pool holds, the server thread suspends and never returns. A liveness probe after one such datagram times out with the pool at 0 of 12 packets and the server thread suspended, and no later client is served. Reject `nx_packet_length > 4 + NX_TFTP_FILE_TRANSFER_MAX` in the DATA branch before either call, and use a bounded wait rather than NX_WAIT_FOREVER for the copy. In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the received packet into the file and read it back by downloading the file, and the same datagram can suspend the server thread permanently.
Title NetX Duo TFTP Server Overflow and DoS from Oversized DATA datagrams Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N'}

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse netx Duo
Vendors & Products Eclipse
Eclipse netx Duo

Tue, 29 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Title NetX Duo TFTP Server Overflow and DoS from Oversized DATA datagrams

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX. Two things follow from that one missing check, both reachable before any authentication because TFTP has none. The handler passes `nx_packet_length - 4` straight to FileX: ```c /* addons/tftp/nxd_tftp_server.c:1863, 1889 */ status = nx_packet_copy(packet_ptr, &temp_ptr, server_ptr -> nx_tftp_server_packet_pool_ptr, NX_WAIT_FOREVER); ... fx_file_write(&(client_request_ptr -> nx_tftp_client_request_file), packet_ptr -> nx_packet_prepend_ptr + 4, packet_ptr -> nx_packet_length - 4); ``` `nx_packet_length` is the length of a chain, not of one contiguous buffer, so FileX copies past the end of the first packet: ``` ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1280 at 0x621000001108 thread T5 #0 __interceptor_memcpy #1 _fx_utility_memory_copy filex/common/src/fx_utility_memory_copy.c:78 0x621000001108 is 0 bytes to the right of 4104-byte region ``` Those bytes are written into the file the attacker is uploading, and a TFTP read request hands them back, so this is a memory disclosure with a convenient retrieval channel. The same datagram also wedges the server. `nx_packet_copy` at :1863 needs ceil(nx_packet_length / pool_payload) packets and asks for them with NX_WAIT_FOREVER, so when the attacker sizes the datagram beyond what the pool holds, the server thread suspends and never returns. A liveness probe after one such datagram times out with the pool at 0 of 12 packets and the server thread suspended, and no later client is served. Reject `nx_packet_length > 4 + NX_TFTP_FILE_TRANSFER_MAX` in the DATA branch before either call, and use a bounded wait rather than NX_WAIT_FOREVER for the copy.
Weaknesses CWE-125
CWE-770
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Netx Duo
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-11-04T13:03:50.427Z

Reserved: 2026-09-29T16:15:09.632Z

Link: CVE-2026-102713

cve-icon Vulnrichment

Updated: 2026-09-29T18:44:34.697Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:10.457

Modified: 2026-11-04T13:17:20.323

Link: CVE-2026-102713

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T15:45:15Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-770

    Allocation of Resources Without Limits or Throttling