L0Stheart

**Name of the Vulnerable Software and Affected Versions** NetX Duo TFTP server (affected versions not specified) **Description** The TFTP server fails to validate the upper bound of DATA datagram sizes, ignoring the protocol maximum of 4 + `NX TFTP FILE TRANSFER MAX`. This lack of validation leads to two primary issues. First, the server passes the `nx packet length` minus 4 directly to FileX via the `fx file write()` function. Because `nx packet length` represents a chain length rather than a contiguous buffer, FileX may copy data beyond the end of the first packet, resulting in a heap-buffer-overflow. This allows an attacker to write memory contents into an uploaded file, which can then be retrieved via a TFTP read request, leading to memory disclosure. Second, the `nx packet copy()` function uses `NX WAIT FOREVER` when requesting packets from the pool. If a datagram exceeds the pool capacity, the server thread suspends indefinitely, causing a denial of service where no further clients can be served. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Reject any DATA datagram where `nx packet length` is greater than 4 + `NX TFTP FILE TRANSFER MAX` before processing the copy or write calls. Replace the `NX WAIT FOREVER` parameter in the `nx packet copy()` function with a bounded wait to prevent server suspension.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw exists in the ` nx icmpv6 validate options()` function where it fails to examine a one- or two-byte residue at the end of an option area. This allows subsequent processing functions to re-walk the area and encounter attacker-controlled bytes, leading to three potential outcomes: 1. If a zero length byte is present, the handlers ` nx icmpv6 process ra()`, ` nx icmpv6 process ns()`, ` nx icmpv6 process na()`, and ` nx icmpv6 process redirect()` enter an infinite loop. Since this occurs in the high-priority IP thread without yielding, the system hangs until a watchdog reset occurs. 2. If a non-zero length byte is present on a short residue, unsigned counters may underflow, causing the process to read past the packet buffer until a fault occurs or a zero length byte is encountered. 3. If a one-byte residue exists, the walker over-reads one byte when reading a two-byte option header. Additionally, during a runaway walk, bytes interpreted as a link-layer address option may be copied into the neighbor cache and used as a destination MAC, potentially leaking off-packet memory onto the link. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A heap-buffer-overflow occurs when a host on the local area network sends two mDNS records with owner names whose lengths fall into the same rounded slot size bucket (for example, names between 12 and 15 characters). The system incorrectly matches a second name to an existing slot based on the rounded size rather than the actual string length. Consequently, the ` nx mdns packet rr add()` function performs a bound check using a stale length, while the ` nx mdns name string encode()` function writes the actual, longer string. This results in one to three bytes of attacker-influenced data being written past the `nx packet data end` boundary, potentially corrupting neighboring packets or the pool free list. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetX RTSP Server (affected versions not specified) **Description** An unauthenticated client can cause a denial of service by draining the RTSP server's packet pool. This occurs when requests are sent containing a `Session` header that the parser cannot convert. Specifically, the ` nx utility string to uint()` function fails and returns a raw NetX error code instead of a mapped RTSP status code. This raw code is then passed to the ` nx rtsp server error response send()` function, which fails to recognize it and returns without releasing the allocated response packet. Consequently, the packet block is not returned to the pool. A small number of such malformed requests can deplete the entire pool, causing the server and potentially the rest of the application stack to stop functioning. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A heap-buffer-overflow occurs when a DHCP server or a malicious actor on the local area network responds to a DISCOVER message. The issue stems from an incorrect bound check during the option walk process, where a pointer and an offset are kept out of sync. Specifically, for every TLV (Type-Length-Value) option skipped, the offset falls one byte behind the actual read position. This allows the system to read approximately one kilobyte past the end of the received message if a long sequence of skippable options is provided in an OFFER message. This read operation occurs in the DHCP client thread during boot while the client is unconfigured, and the leaked bytes can be used to configure the interface, making the disclosed information observable. The flaw is located in the ` nx dhcp search buffer()` function, which is called by ` nx dhcp get option value()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A heap-buffer-overflow occurs when a TFTP server responds with a short ERROR packet. The client only verifies that the datagram is at least four bytes long, but fails to compare the `buffer ptr` against the `nx packet append ptr` when copying the message string. If an ERROR packet lacks a terminating NUL byte, the loop continues reading past the end of the packet until a zero byte is encountered or the 64-byte destination buffer is filled. This allows adjacent packet pool memory to be leaked into the `nx tftp client error string` variable, which may then be displayed or logged by the application. This issue affects the ` nxd tftp client file read()` function and other receive paths in the `nxd tftp client.c` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.