HIGH🇵🇱 Wersja polska

CVE-2026-7422

CVSS 7.1v4.0pub. 2026-04-29upd. 2026-05-04

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.

CVSS Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Amazon Freertos Plus Tcp

    APP
    Amazon
    4.0.0 – 4.2.6 (excl.)4.3.0 – 4.4.1 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-38373CRITICAL9.6PL ✓same product

Buffer over-read w parserze DNS biblioteki FreeRTOS-Plus-TCP

CVE-2026-7424HIGH7.2same product

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adja...

CVE-2026-7426MEDIUM6.1same product

Niedostateczna walidacja pola długości prefiksu w przetwarzaniu IPv6 Router Advertisement w FreeRTOS-Plus-TCP ...

CVE-2026-7423MEDIUM6.0same product

Integer underflow w obsługiwaczach odpowiedzi ICMP i ICMPv6 echo w FreeRTOS-Plus-TCP przed wersjami V4.4.1 i V...

CVE-2026-7425MEDIUM6.0same product

Niewystarczające walidowanie długości opcji w parserze IPv6 Router Advertisement w FreeRTOS-Plus-TCP przed wer...