← Back

CVE-2026-7422

nvd nist
Published: Apr 29, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.1
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5 (Secondary)

Description

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.

Affected (2)

Amazon
1 product
Freertos Plus Tcp
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Amazon
Freertos Plus Tcp
From 4.0.0 to 4.2.6
Freertos Plus Tcp
From 4.3.0 to 4.4.1

Related CWEs

CWE-290
Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (4)

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Vendor Advisory
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Release Notes
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Release Notes
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
PatchVendor Advisory

Timeline

No history available yet.