Incomplete cleanup in NetX Duo - CVE-2025-0726
Published: February 21, 2025 / Updated: November 9, 2026
Vulnerability identifier: #VU162950
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-0726
CWE-ID: CWE-459
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to deny access to file resources served by NetX Duo HTTP servers.
The vulnerability exists due to incomplete file cleanup in both HTTP server implementations when an HTTP PUT request times out after opening a file. A low-privileged remote attacker can send a PUT request with an inflated Content-Length and withhold remaining data, leaving the file open and causing subsequent file requests to fail.
Affected software
NetX Duo
How to mitigate CVE-2025-0726
Install security update from vendor's website.
NetX Duo - update to 6.4.2