CVE-2025-2260

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2260
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error for each further file request. Users can work-around the issue by disabling the PUT request support. This issue follows an incomplete fix of CVE-2025-0726.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/eclipse-threadx/netxduo/commit/fb3195bbb6d0d6fe71a7a19585c008623c217f9e Patch
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-f42f-6fvv-xqx3 Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2098 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:*
History

31 Jul 2025, 16:31

Type Values Removed Values Added
First Time Eclipse
Eclipse threadx Netx Duo
References () https://github.com/eclipse-threadx/netxduo/commit/fb3195bbb6d0d6fe71a7a19585c008623c217f9e - () https://github.com/eclipse-threadx/netxduo/commit/fb3195bbb6d0d6fe71a7a19585c008623c217f9e - Patch
References () https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-f42f-6fvv-xqx3 - () https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-f42f-6fvv-xqx3 - Vendor Advisory
References () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2098 - () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2098 - Third Party Advisory
CPE cpe:2.3:a:eclipse:threadx_netx_duo:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

14 Apr 2025, 15:15

Type Values Removed Values Added
References
  • () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2098 -

07 Apr 2025, 14:17

Type Values Removed Values Added
Summary
  • (es) En la funcionalidad del servidor HTTP NetX de Eclipse ThreadX NetX Duo anterior a la versión 6.4.3, un atacante podía provocar una denegación de servicio mediante paquetes especialmente manipulados. El problema principal radica en que no se cierra un archivo en caso de error, lo que genera un error 404 con cada solicitud de archivo posterior. Los usuarios pueden solucionar el problema deshabilitando la compatibilidad con solicitudes PUT. Este problema surge tras una corrección incompleta de CVE-2025-0726.

06 Apr 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-06 19:15

Updated : 2025-07-31 16:31

NVD link : CVE-2025-2260

Mitre link : CVE-2025-2260

CVE.ORG link : CVE-2025-2260

JSON object : View

Products Affected

eclipse

  • threadx_netx_duo
CWE
CWE-459

Incomplete Cleanup