CVE-2025-2258 - CVE House

Back to Database

Status published Medium CVE-2025-2258

Eclipse ThreadX NetX Duo HTTP server single PUT request integer underflow

5.3 CVSS

Vulnerability Description

In NetX Duo component HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause an integer underflow and a subsequent denial of service by writing a very large file, by specially crafted packets with Content-Length smaller than the data request size. A possible workaround is to disable HTTP PUT support. This issue follows an uncomplete fix in CVE-2025-0728.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2258

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Kelly Patterson of Cisco Talos

References

More from Eclipse Foundation

View All →

In Jakarta Mail versions prior to 2.0.2 it is possible...

A vulnerability in the Eclipse Open VSX Registry’s automated publishing...

A denial-of-service vulnerability exists in the NetX IPv6 component functionality...

Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()

Potential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()

Affected Vendor

Eclipse Foundation

View all reports →

Affected Software

ThreadX

Vulnerable Versions:

0

Timeline

Official Publish: April 6th, 2025

Last Modified: April 15th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1574 Hijack Execution Flow

Privilege Escalation

T1059 Command and Scripting Interpreter

T1485 Data Destruction

T1499 Endpoint Denial of Service