Eclipse ThreadX NetX Duo: Use of uninitialized pointer in Web HTTP server
Summary
The Web add-on of NetX Duo, a TCP/IP stack for embedded and IoT devices, releases an uninitialized packet pointer when a PUT request has a Content-Length underflow. An unauthenticated remote attacker can trigger this with a single malformed request, which can crash the HTTP server. If the build disables NetX Duo error checking, the release can also corrupt the packet pool. Exposure depends on whether PUT requests are accepted without authentication.
Affected
- Eclipse ThreadX NetX Duo 6.4.2 to 6.5.1.202602 (Web add-on HTTP server)
- Legacy HTTP add-on is not affected
Fixed in
- NetX Duo 6.5.2.202603 or later
Workaround
- Unknown. No vendor-published workaround found.
- Disable the Web add-on if it is not needed.
- Require authentication for PUT requests, which limits access to authenticated clients.
Exploitation
- No known exploitation in the wild. CISA SSVC: exploitation none, automatable yes.
- Not listed in the CISA KEV catalog.
- Public PoC status is unverified; sources conflict.
Our recommendation
- Identify embedded devices or firmware that use NetX Duo 6.4.2 to 6.5.1.202602 with the Web add-on.
- Ask device vendors for firmware with NetX Duo 6.5.2.202603 or later.
- Block inbound access to the HTTP/PUT service from untrusted networks until patched.
- Verify the vendor advisory and PoC status at the next review.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wjxf-gjm5-jh5q github.com
- Eclipse ThreadX NetX Duo release 6.5.2.202603 github.com
- OpenCVE CVE-2026-94018 app.opencve.io
- Vulners OSV CVE-2026-94018 vulners.com
- TheHackerWire CVE-2026-94018 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:34.
Original description (NVD)
The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.