The NetX Duo SNMP addon contains an out‑of‑bounds read in the function that parses received OID data. An attacker can craft an SNMP packet with a multibyte OID length larger than the buffer that holds the OID. The parser then reads past the buffer into adjacent heap memory, treating the beyond‑boundary bytes as part of the OID string. This corrupts the SNMP agent’s internal state or, on systems with memory protection enabled, causes the SNMP thread to crash. Both outcomes result in a denial of service and loss of availability for the SNMP agent, potentially affecting network management and monitoring functions.

Eclipse Foundation’s NetX Duo platform is affected. The vulnerable component is the SNMP addon that processes OID data. No specific version information is supplied, so any deployment of NetX Duo that includes the SNMP extension is potentially impacted until a patch is applied.

The CVSS score of 8.7 indicates high severity. The exploit requires remote network access to the SNMP service and the ability to send a specially crafted packet. Although EPSS data is missing, the nature of the flaw—an out‑of‑bounds read that can crash or corrupt memory—is a compelling risk for embedded devices, especially those lacking memory protection. The vulnerability is not currently listed in the CISA KEV catalog, but its impact on embedded systems makes it a priority for remediation.