In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the request without checking it against the bytes present, and reads past the end of the packet buffer. A remote, unauthenticated attacker can send a crafted SNMP request that makes the agent read adjacent memory into its OID state, faulting the agent on targets with memory protection.