CVE-2026-102552

Published: Oct 16, 2026Modified: Oct 19, 2026

8.2

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5 (Secondary)

Description

Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.

Related CWEs

CWE-940

Improper Verification of Source of a Communication Channel

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

References (3)

https://aws.amazon.com/security/security-bulletins/2026-139-aws/

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.2

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-h4fw-pv82-p7h5

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Timeline

No history available yet.