6.9
Moyenne
CVE-2025-55081 In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was…
Description
In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of certain SSL/TLS client hello message: the ciphersuite length and compression method length. In case of an attacker-crafted message with values outside of the expected range, it could cause an out-of-bound read.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| NetX Duo 6.4 | premières → < 6.4.4 | 6.4.4 |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de NetX Duo
Les 32 CVE de NetX Duo →
CVE-2026-106465
Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server
6.9
Moyenne
CVE-2026-106464
Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing
8.7
Élevée
CVE-2026-103415
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without…
9.3
Critique
CVE-2026-102717
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
7.5
Élevée