NetX Duo SNMP Addon Out-of-Bounds Read Vulnerability in Eclipse ThreadX

A vulnerability allowing out-of-bounds read has been identified in NextX Duo's SNMP addon, affecting versions through 6.4.3. This issue arises from the SNMPv3 security parameters being parsed without proper length checks, enabling attackers to craft requests that exploit this oversight. The vulnerability is rooted in the `_nx_snmp_version_3_process` function within `nxd_snmp.c`, where the absence of buffer length validation before accessing the security parameters can lead to reading memory outside the allocated buffer, particularly when the buffer length is short.

Impact

Exploitation of this vulnerability could cause system crashes, instability, or memory corruption.

Remediation

Users can upgrade to NetX Duo version 6.4.4 to address this vulnerability.