Integer underflow in NetX Duo - CVE-2025-0728
Published: February 21, 2025 / Updated: November 9, 2026
Vulnerability identifier: #VU162948
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-0728
CWE-ID: CWE-191
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker with low privileges to cause denial of service by exhausting file system resources.
The vulnerability exists due to an integer underflow in both NetX Duo HTTP server implementations when a PUT request contains more body data than its declared Content-Length. A remote attacker with low privileges can send this crafted request and continue transmitting data, causing the server to write an excessively large file.
Affected software
NetX Duo
How to mitigate CVE-2025-0728
Install security update from vendor's website.
NetX Duo - update to 6.4.2