{"id":"CVE-2026-102551","kind":"vulnerability","aliases":["CVE-2026-102551"],"related":[],"title":"Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon…","description":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\n### CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\nBulletin ID: 2026-139-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:15 AM PDT\n\nDescription:\n\nFreeRTOS-Plus-TCP is an open-source, thread-safe TCP/IP stack for the FreeRTOS kernel, distributed by Amazon for use on embedded and IoT devices. AWS identified two issues with FreeRTOS-Plus-TCP, affecting multiple versions.\n\nCVE-2026-102551: improper verification of the source of a communication channel in the IPv6 Router Advertisement handler. The handler does not fully validate that a received Router Advertisement originates from an on-link source before acting on it. Under certain conditions, a remote third-party might influence an endpoint's IPv6 gateway, prefix, and address configuration, potentially enabling interception of the device's IPv6 traffic. This issue is reachable in the library's default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled.\n\nCVE-2026-102552: improper verification of the source of a communication channel in the DNS resolver. The resolver does not fully validate that a DNS reply originates from the server that was queried before accepting it. Under certain conditions, a remote third-party might insert a chosen address into the device's DNS cache, potentially redirecting the device's subsequent connections for the affected name.\n\nImpacted versions:\n\n- CVE-2026-102551 (Router Advertisement): <= V4.4.1\n- CVE-2026-102552 (DNS resolver): <= V4.4.1\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Plus-TCP version V4.4.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nFor the DNS resolver issue, responder source-IP validation is provided as an opt-in option and is disabled by default; upgrading alone does not remediate it. To remediate, upgrade to V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h.\n\nWorkarounds:\n\n- CVE-2026-102551 (Router Advertisement): If upgrading is not immediately possible, disable IPv6 Router Advertisement processing by setting ipconfigUSE_RA to ipconfigDISABLE (or disable IPv6 entirely with ipconfigUSE_IPv6 = ipconfigDISABLE) in FreeRTOSIPConfig.h where the device does not require IPv6 RA-based autoconfiguration. On the network side, deploying RA Guard and/or SEND on the local link mitigates the on-link vector but does not address the off-link vector reachable during lease-renewal windows.\n- CVE-2026-102552 (DNS resolver): There is no configuration-only workaround on affected versions, because responder source-IP validation does not exist prior to V4.4.2. Where feasible, restricting the device to a trusted local resolver and protecting the local network path reduces unintended access to off-path reply forgery but does not eliminate the issue.\n\nReferences:\n\n- CVE-2026-102551\n- CVE-2026-102552\n- GHSA-pjq5-fqrr-g6pv\n- GHSA-h4fw-pv82-p7h5\n\nAcknowledgement:\n\nWe would like to thank Cipher / Causal Security for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Amazon FreeRTOS-Plus-TCP before V4.4.2 does not verify the source of IPv6 Router Advertisement messages. A remote attacker on the local network can send a crafted Router Advertisement to change a device's IPv6 default gateway, on-link prefix and address configuration, which can redirect or intercept its traffic.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amazon-freertos","aws","embedded","freertos","iot","lab-disclosure","package"],"not_affected_if":["fixed-version","ipv4-only","ipv6-disabled"],"how_to_check":"Check whether the firmware or application links FreeRTOS-Plus-TCP and find its version (V4.4.2 or later is fixed).","fix":"Upgrade FreeRTOS-Plus-TCP to V4.4.2 or later.","status":"open","published_at":"2026-10-16T00:00:00+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:09:09+00:00","updated_at":"2026-10-24T18:56:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:09:09Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade FreeRTOS-Plus-TCP to V4.4.2 or later.\nunknown","reach":"network","impact":"medium","summary":"Amazon FreeRTOS-Plus-TCP before V4.4.2 does not verify the source of IPv6 Router Advertisement messages. A remote attacker on the local network can send a crafted Router Advertisement to change a device's IPv6 default gateway, on-link prefix and address configuration, which can redirect or intercept its traffic.","category":"package","who_cares":["freertos","embedded","iot","amazon-freertos"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker redirects device traffic via forged IPv6 gateway and prefix","analyst_note":"Confirm the affected version range and which FreeRTOS release or vendor firmware ships the fix; check the NVD entry and the Amazon FreeRTOS advisory for details.","how_to_check":"Check whether the firmware or application links FreeRTOS-Plus-TCP and find its version (V4.4.2 or later is fixed).\nunknown","needs_analyst":true,"not_affected_if":["ipv4-only","ipv6-disabled","fixed-version"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000509,"input_tokens":2798,"output_tokens":459,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-102551':20A,23A,89C,101C,173C,328C,418C,554C '-102552':92C,104C,260C,334C,495C,557C '-139':114C '-2026':19A,22A,88C,91C,100C,103C,172C,259C,327C,333C,417C,494C,553C,556C '10':126C '10/16/2026':125C '15':127C '2026':113C 'accept':292C 'access':538C 'acknowledg':568C 'act':208C 'address':78B,228C,306C,343C,481C 'advertis':14A,50B,64B,187C,199C,330C,420C,430C 'affect':168C,322C,506C 'alon':396C 'amazon':17A,25B,35B,151C 'amazon-freerto':24B 'and/or':466C 'attack':54B 'attent':122C 'autoconfigur':458C 'aw':27B,115C,117C,159C 'aws-security@amazon.com':590C 'base':457C 'bulletin':111C 'cach':312C 'causal':575C 'certain':212C,295C 'chang':66B 'channel':9A,182C,269C 'check':409C 'chosen':305C 'cipher':574C 'code':364C 'collabor':578C 'communic':8A,181C,268C 'concern':596C 'condit':213C,296C 'configur':79B,229C,248C,502C 'configuration-on':501C 'connect':319C 'content':118C 'coordin':584C 'craft':62B 'cve':18A,21A,87C,90C,99C,102C,171C,258C,326C,332C,416C,493C,552C,555C 'date':124C 'default':71B,247C,394C 'deploy':463C 'deriv':363C 'descript':130C 'devic':68B,158C,235C,309C,316C,450C,524C 'disabl':392C,427C,439C 'disclosur':33B,586C 'distribut':149C 'dns':272C,282C,311C,335C,374C,496C 'elimin':548C 'email':589C 'embed':28B,155C 'enabl':231C,257C,407C 'endpoint':222C 'ensur':359C 'entir':441C 'exist':516C 'feasibl':521C 'fix':371C 'forgeri':544C 'fork':361C 'fqrr':561C 'freerto':26B,29B,37B,96C,108C,132C,147C,165C,346C 'freertos-plus-tcp':36B,95C,107C,131C,164C,345C 'freertosipconfig.h':414C,447C 'fulli':193C,278C 'g6pv':562C 'gateway':72B,225C 'ghsa':559C,564C 'ghsa-h4fw-pv82-p7h5':563C 'ghsa-pjq5-fqrr-g6pv':558C 'guard':465C 'h4fw':565C 'handler':15A,188C,190C 'id':112C 'identifi':160C 'immedi':425C 'impact':324C 'import':120C 'improp':1A,174C,261C 'incorpor':368C 'influenc':220C 'insert':303C 'intercept':84B,232C 'iot':30B,157C 'ip':380C,412C,512C 'ipconfigdis':437C,445C 'ipconfigdn':408C 'ipconfigus':250C,253C,434C,443C 'ipv6':12A,48B,70B,185C,224C,237C,251C,428C,440C,444C,454C 'issu':93C,105C,162C,240C,340C,376C,550C,581C 'kernel':148C 'lab':32B 'lab-disclosur':31B 'latest':356C 'leas':490C 'lease-renew':489C 'librari':245C 'like':571C 'link':75B,205C,471C,476C,485C 'local':57B,470C,528C,533C 'messag':51B 'might':219C,302C 'mitig':472C 'multipl':169C 'name':323C 'network':58B,461C,534C 'new':370C 'off-link':483C 'off-path':540C 'on-link':73B,203C,474C 'open':138C 'open-sourc':137C 'opt':387C 'opt-in':386C 'option':389C 'origin':200C,284C 'p7h5':567C 'packag':34B 'parti':218C,301C 'patch':366C 'path':535C,542C 'pdt':129C 'pjq5':560C 'pleas':588C 'plus':38B,97C,109C,133C,166C,347C 'possibl':426C 'potenti':230C,313C 'prefix':76B,226C 'prior':517C 'process':431C,587C 'protect':531C 'provid':383C 'public':123C 'pv82':566C 'queri':290C 'question':594C 'ra':254C,435C,456C,464C 'ra-bas':455C 'reachabl':242C,487C 'receiv':197C 'recommend':352C 'redirect':82B,314C 'reduc':536C 'refer':551C 'remedi':399C,402C 'remot':53B,215C,298C 'renew':491C 'repli':283C,410C,543C 'requir':121C,453C 'resolut':338C 'resolv':273C,275C,336C,375C,497C,529C 'respond':377C,509C 'restrict':522C 'router':13A,49B,63B,186C,198C,329C,419C,429C 'safe':142C 'scope':116C 'secur':576C,593C 'send':60B,467C 'server':287C 'set':433C 'side':462C 'sourc':5A,46B,139C,178C,206C,265C,379C,411C,511C 'source-ip':378C,510C 'stack':144C 'subsequ':318C 'tcp':39B,98C,110C,134C,167C,348C 'tcp/ip':143C 'thank':573C 'third':217C,300C 'third-parti':216C,299C 'thread':141C 'thread-saf':140C 'traffic':86B,238C 'trust':527C 'two':161C 'type':119C 'unintend':537C 'upgrad':353C,395C,403C,422C 'use':153C 'v4.4.1':331C,337C 'v4.4.2':41B,350C,405C,519C 'valid':194C,279C,381C,513C 'vector':477C,486C 'verif':2A,175C,262C 'verifi':44B 'version':170C,325C,349C,357C,507C 'vulner':585C 'window':492C 'workaround':415C,504C 'would':570C","nicknames":[],"mitigations":[{"kind":"workaround","scope":"FreeRTOS-Plus-TCP IPv6 Router Advertisement handler","since":null,"covers":"Devices where ipconfigUSE_RA is set to ipconfigDISABLE, so Router Advertisements are not processed","limits":"Does not apply where the device needs IPv6 RA-based autoconfiguration; ipconfigUSE_IPv6 can instead be disabled entirely","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/","vendor":"Team","seen_at":"2026-10-24T18:56:52Z","confidence":0.9,"source_title":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP","customer_action":"Set ipconfigUSE_RA to ipconfigDISABLE (or ipconfigUSE_IPv6 to ipconfigDISABLE) in FreeRTOSIPConfig.h until upgrading to V4.4.2"},{"kind":"workaround","scope":"Local network for FreeRTOS-Plus-TCP IPv6 Router Advertisements","since":null,"covers":"On-link Router Advertisement vector, via RA Guard and/or SEND deployed on the local link","limits":"Does not address the off-link vector reachable during lease-renewal windows","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/","vendor":"Team","seen_at":"2026-10-24T18:56:52Z","confidence":0.75,"source_title":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP","customer_action":"Deploy RA Guard and/or SEND on the local link"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102551","severity":null,"published_at":"2026-10-16T18:17:14+00:00","modified_at":"2026-10-19T13:16:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/#CVE-2026-102551","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/","severity":null,"published_at":"2026-10-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:55+00:00","fetched_at":"2026-10-24T18:56:55+00:00","note":"AWS: CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP"}],"documents":[{"id":2916,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/","title":"AWS: CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP","kind":"advisory","source":"lab","text":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\n### CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\nBulletin ID: 2026-139-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:15 AM PDT\n\nDescription:\n\nFreeRTOS-Plus-TCP is an open-source, thread-safe TCP/IP stack for the FreeRTOS kernel, distributed by Amazon for use on embedded and IoT devices. AWS identified two issues with FreeRTOS-Plus-TCP, affecting multiple versions.\n\nCVE-2026-102551: improper verification of the source of a communication channel in the IPv6 Router Advertisement handler. The handler does not fully validate that a received Router Advertisement originates from an on-link source before acting on it. Under certain conditions, a remote third-party might influence an endpoint's IPv6 gateway, prefix, and address configuration, potentially enabling interception of the device's IPv6 traffic. This issue is reachable in the library's default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled.\n\nCVE-2026-102552: improper verification of the source of a communication channel in the DNS resolver. The resolver does not fully validate that a DNS reply originates from the server that was queried before accepting it. Under certain conditions, a remote third-party might insert a chosen address into the device's DNS cache, potentially redirecting the device's subsequent connections for the affected name.\n\nImpacted versions:\n\n- CVE-2026-102551 (Router Advertisement): <= V4.4.1\n- CVE-2026-102552 (DNS resolver): <= V4.4.1\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Plus-TCP version V4.4.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nFor the DNS resolver issue, responder source-IP validation is provided as an opt-in option and is disabled by default; upgrading alone does not remediate it. To remediate, upgrade to V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h.\n\nWorkarounds:\n\n- CVE-2026-102551 (Router Advertisement): If upgrading is not immediately possible, disable IPv6 Router Advertisement processing by setting ipconfigUSE_RA to ipconfigDISABLE (or disable IPv6 entirely with ipconfigUSE_IPv6 = ipconfigDISABLE) in FreeRTOSIPConfig.h where the device does not require IPv6 RA-based autoconfiguration. On the network side, deploying RA Guard and/or SEND on the local link mitigates the on-link vector but does not address the off-link vector reachable during lease-renewal windows.\n- CVE-2026-102552 (DNS resolver): There is no configuration-only workaround on affected versions, because responder source-IP validation does not exist prior to V4.4.2. Where feasible, restricting the device to a trusted local resolver and protecting the local network path reduces unintended access to off-path reply forgery but does not eliminate the issue.\n\nReferences:\n\n- CVE-2026-102551\n- CVE-2026-102552\n- GHSA-pjq5-fqrr-g6pv\n- GHSA-h4fw-pv82-p7h5\n\nAcknowledgement:\n\nWe would like to thank Cipher / Causal Security for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-16T00:00:00+00:00","relation":"advisory","confidence":null,"note":"AWS disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}