In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure‑Nak without validating the length of each option. A malicious PPP peer can stall the PPP thread indefinitely using a zero‑length option, effectively taking the link down, and can read up to four bytes of packet‑buffer memory per exchange when a short address option is used. This failure may expose internal memory contents and cause a denial of service. The vulnerability has a CVSS score of 7.1, indicating moderate to high severity.

Eclipse Foundation: NetX Duo. Affected versions are 6.0 through 6.5.2.202603a, as specified in the advisory.

The CVSS score of 7.1 signals a moderate to high impact. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a network‑based attacker that injects malformed PPP IPCP options into the device. The exploit requires only network access to the PPP link; no local privileges are needed. If successful, the attacker can either cause a denial of service by stalling the worker thread or read confidential memory, depending on how the out‑of‑bounds read is leveraged.