Executive brief
Eclipse ThreadX NetX Duo is a networking stack used in embedded and IoT devices to handle internet communications. A flaw in how the software handles file uploads (HTTP PUT requests) can cause the system to crash or behave unpredictably when an error occurs. This could allow a remote attacker to disrupt the device's operations or cause a service outage.
Technical details
A regression was introduced in the fix for CVE-2025-0728 within the NetX Duo HTTP server. The refactored error handling for HTTP PUT operations utilizes a shared cleanup label that unconditionally calls fx_file_close(). If an error occurs before a file is successfully opened, the system attempts to close an uninitialized file handle. This leads to a use-of-uninitialized-resource condition, potentially resulting in double-close issues, memory corruption, or undefined behavior. The vulnerability is reachable over the network without authentication via specially crafted HTTP PUT requests.
Affected products
- Eclipse Foundation NetX Duo 6.4.2 to 6.5.0.202601
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory