The Eclipse ThreadX NetX Duo SNMP agent parses packet contents through an out‑of‑bounds read in the OID processor. The parser accepts a multi‑byte BER length from the request without validating that the length is within the packet’s actual size, and then continues reading past the end of the packet buffer into adjacent memory. A remote, unauthenticated attacker can send a crafted SNMP packet that causes the agent to spill memory into its OID state; on devices with memory protection enabled this triggers a fault and crashes the SNMP thread.

Eclipse ThreadX NetX Duo, specifically the SNMP agent component, is affected in all releases up to and including version 6.5.2.202603. Any embedded system that contains this component without the update is potentially impacted.

The flaw is present in all releases up to and including 6.5.2.202603, affecting any device that ships NetX Duo with the SNMP extension. The CVSS score of 8.7 indicates high severity, primarily causing denial of service by crashing the SNMP agent. Exploitation requires sending a malformed SNMP request to an open SNMP port and can be performed by an unauthenticated remote attacker. The EPSS score is less than 1%, suggesting a low current exploitation probability, but the vulnerability is not listed in the CISA KEV catalog, meaning that the absence from KEV does not diminish its relevance to embedded or industrial control environments.