The vulnerability in Eclipse Foundation NetX Duo FTP Client arises from insufficient validation of the server's '227' reply in the IPv4 PASV path. The client accepts any IP address sent by the server as long as it parses correctly and is non-zero, enabling a malicious server to redirect the client to arbitrary network locations. This is classified as CWE-918 (Server-Side Request Forgery). The affected versions are from 0 up to and including 6.5.1.202602. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

An attacker controlling the FTP server can exploit this vulnerability to cause the client to make network requests to arbitrary IP addresses. This could potentially be used to access internal network resources or services that are otherwise inaccessible to the attacker. There is no indication of privilege escalation or direct data compromise from the client itself. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the Eclipse Foundation advisories for updates. Until a fix is available, avoid connecting to untrusted FTP servers or use network controls to limit the client's ability to reach sensitive internal addresses.