SB2025022151 - Multiple vulnerabilities in NetX Duo
Published: February 21, 2025 Updated: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Integer underflow (CVE-ID: CVE-2025-0728)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker with low privileges to cause denial of service by exhausting file system resources.
The vulnerability exists due to an integer underflow in both NetX Duo HTTP server implementations when a PUT request contains more body data than its declared Content-Length. A remote attacker with low privileges can send this crafted request and continue transmitting data, causing the server to write an excessively large file.
2) Integer underflow (CVE-ID: CVE-2025-0727)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged remote attacker to cause denial of service by exhausting file system resources.
The vulnerability exists due to an integer underflow in both NetX Duo HTTP server implementations when a PUT request's declared content length is smaller than the data received in a subsequent packet. A low-privileged remote attacker can send this crafted request and continue transmitting data to force an excessively large file to be written.
3) Incomplete cleanup (CVE-ID: CVE-2025-0726)
CWE-ID: CWE-459 - Incomplete cleanup
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged remote attacker to deny access to file resources served by NetX Duo HTTP servers.
The vulnerability exists due to incomplete file cleanup in both HTTP server implementations when an HTTP PUT request times out after opening a file. A low-privileged remote attacker can send a PUT request with an inflated Content-Length and withhold remaining data, leaving the file open and causing subsequent file requests to fail.
Remediation
Install update from vendor's website.