The vulnerability allows an FTP server to accept a passive data connection from an unauthenticated client that is not the one who requested passive mode. In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the first connection to the passive data port is queued without verifying its origin, which enables an attacker to intercept a file that an authenticated user downloads, or to supply content that the user intends to upload. This flaw is a failure to bind the data transfer to the authenticated control session and corresponds to CWE-923.

The vulnerability affects the Eclipse Foundation's ThreadX NetX Duo firmware versions 6.0 through 6.5.2.202603a. In each of these releases, the FTP server accepts passive data connections without binding them to the authenticated control session. Devices running any of these firmware versions are vulnerable and should be monitored or upgraded when a fix becomes available.

The CVSS score of 6 indicates a medium severity. The EPSS score is reported as less than 1% (approximately 0.00197), indicating a very low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited widespread exploitation. The likely attack vector is remote, exploiting the FTP protocol over a network to establish a data connection misassociated with the control session.