Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-2260: Eclipse ThreadX NetX Duo HTTP server can be stopped

CVE-2025-2260 · published 1 year ago

Summary

The HTTP server in Eclipse ThreadX NetX Duo versions before 6.4.3 can be forced to stop responding when it receives specially crafted network packets. This happens because the server fails to close a file after an error, causing every later request to return a 404 error. To protect systems, disable support for PUT requests until the software is updated to version 6.4.3 or later.

What to do

Update eclipse threadx_netx_duo to version 6.4.3 or later.

Affected software

Vendor	Product	Affected versions
eclipse	threadx_netx_duo	< 6.4.3 `cpe:2.3:a:eclipse:threadx_netx_duo::::::::`

Original advisory text

Eclipse ThreadX NetX Duo HTTP component server denial of service

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before
version 6.4.3, an attacker can cause a denial of service by specially
crafted packets. The core issue is missing closing of a file in case of
an error condition, resulting in the 404 error for each further file
request. Users can work-around the issue by disabling the PUT request
support.

This issue follows an incomplete fix of CVE-2025-0726.

References

https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2098 URL
https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-f42f-6fvv-xq... Vendor Advisory
https://github.com/eclipse-threadx/netxduo/commit/fb3195bbb6d0d6fe71a7a19585c008... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2260.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-2260 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-459Incomplete Cleanup

Timeline

Published6 Apr 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-2260 · NVD

CVE-2025-2260 · OSV

GHSA-f42f-6fvv-xqx3 · GHSA

Track software like this

Free during beta