HIGH🇬🇧 English

CVE-2026-7424

CVSS 7.2v4.0pub. 2026-04-29upd. 2026-05-04

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service (permanent IP task freeze requiring hardware reset) by sending a single crafted DHCPv6 packet. The issue is present whenever DHCPv6 is enabled. To mitigate this issue, users should upgrade to version V4.2.6 or V4.4.1 or newer.

oryginał EN
CVSS Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Amazon Freertos Plus Tcp

    APP
    Amazon
    4.0.0 – 4.2.6 (bez)4.3.0 – 4.4.1 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
DoS
CWE
Referencje

Powiązane podatności

CVE-2024-38373CRITICAL9.6PL ✓ten sam produkt

Buffer over-read w parserze DNS biblioteki FreeRTOS-Plus-TCP

CVE-2026-7422HIGH7.1ten sam produkt

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor ...

CVE-2026-7423MEDIUM6.0ten sam produkt

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 all...

CVE-2026-7425MEDIUM6.0ten sam produkt

Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2...

CVE-2026-7426MEDIUM6.1ten sam produkt

Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TC...