CVE-2026-102551

Published: Oct 16, 2026Modified: Oct 19, 2026

9.2

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5 (Secondary)

Description

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement. To remediate this issue, users should upgrade to version V4.4.2.

Related CWEs

CWE-940

Improper Verification of Source of a Communication Channel

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

References (3)

https://aws.amazon.com/security/security-bulletins/2026-139-aws/

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.2

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-pjq5-fqrr-g6pv

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Timeline

No history available yet.