CVE-2025-0727

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-0727
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length in one packet smaller than the data request size of the other packet. A possible workaround is to disable HTTP PUT support.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/eclipse-threadx/netxduo/commit/c78d650be7377aae1a8704bc0ce5cc6f9f189014 Patch
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-jf6x-9mgc-p72w Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:*
History

31 Jul 2025, 16:33

Type Values Removed Values Added
CPE cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
Summary
  • (es) En la funcionalidad del servidor HTTP NetX de Eclipse ThreadX NetX Duo anterior a la versión 6.4.2, un atacante puede provocar un desbordamiento de enteros y una posterior denegación de servicio al escribir un archivo muy grande mediante paquetes especialmente manipulados con una longitud de contenido en un paquete menor que el tamaño de la solicitud de datos del otro paquete. Un posible workaround es deshabilitar la compatibilidad con HTTP PUT.
First Time Eclipse
Eclipse threadx Netx Duo
References () https://github.com/eclipse-threadx/netxduo/commit/c78d650be7377aae1a8704bc0ce5cc6f9f189014 - () https://github.com/eclipse-threadx/netxduo/commit/c78d650be7377aae1a8704bc0ce5cc6f9f189014 - Patch
References () https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-jf6x-9mgc-p72w - () https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-jf6x-9mgc-p72w - Vendor Advisory

21 Feb 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-21 09:15

Updated : 2025-07-31 16:33

NVD link : CVE-2025-0727

Mitre link : CVE-2025-0727

CVE.ORG link : CVE-2025-0727

JSON object : View

Products Affected

eclipse

  • threadx_netx_duo
CWE
CWE-191

Integer Underflow (Wrap or Wraparound)