The vulnerability arises in the NetX Duo TFTP client when processing ERROR packets. The client checks only that the datagram is at least four bytes long but does not verify that the error message string within the packet is properly NUL-terminated. The copying loop reads bytes until it encounters a NUL byte or fills a 64-byte buffer, but since the server controls the packet content, it can omit the terminating NUL. This causes the client to read beyond the packet boundary, up to 64 bytes, resulting in an out-of-bounds read (CWE-125). The leaked data is stored in nx_tftp_client_error_string, which the application may display or log, potentially exposing adjacent packet pool memory. The issue is present in multiple receive paths in the code. The recommended fix is to add a boundary check comparing the buffer pointer against the packet's append pointer to prevent reading beyond the packet data.

An attacker controlling a TFTP server can send a crafted ERROR packet lacking a terminating NUL byte, causing the client to read up to 64 bytes beyond the packet boundary. This out-of-bounds read may leak adjacent memory contents into the error string buffer, which the client application is expected to display or log. This could lead to unintended information disclosure of memory contents from the device running the vulnerable NetX Duo client. There is no indication of remote code execution or denial of service from this vulnerability. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the information disclosure impact with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability can be mitigated by adding a boundary check in the copying loop to ensure the buffer pointer does not exceed the packet's append pointer, preventing out-of-bounds reads. Until an official fix is available, users should avoid connecting to untrusted TFTP servers or implement network controls to restrict TFTP traffic to trusted sources.