Integer Underflow Vulnerability in Eclipse ThreadX NetX Duo HTTP Server Functionality

CVE-2025-0728

What is CVE-2025-0728?

In the HTTP server functionality of Eclipse ThreadX NetX Duo prior to version 6.4.2, an integer underflow vulnerability can be exploited by attackers. This occurs when a specially crafted packet is sent with a Content-Length that is smaller than the actual request size, allowing malicious users to write exceedingly large files. As a result, this vulnerability can lead to a denial of service condition for the affected applications. A possible workaround to mitigate this issue is to disable HTTP PUT support.

References