Live › vulnerability › CVE-2026-102552
Go to dashboardFreeRTOS-Plus-TCP's DNS resolver accepts a reply without checking that it came from the server that was queried. A remote third party can insert a chosen address into the device's DNS cache and redirect its later connections for that name.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Embedded and IoT devices that build FreeRTOS-Plus-TCP at version <= V4.4.1 and resolve DNS names, including forks and derivative code. The risk is greatest where the device sends DNS queries across networks an attacker can reach; devices on a fully trusted local resolver path face less exposure. Teams on with source-IP checking enabled can skip it.
V4.4.2No product ranges from the sources yet.
<= V4.4.1.ipconfigDNS_CHECK_REPLY_SOURCE_IP is defined and enabled in FreeRTOSIPConfig.h.V4.4.2 and patch any forked or derivative code.ipconfigDNS_CHECK_REPLY_SOURCE_IP to enabled in FreeRTOSIPConfig.h; upgrading alone does not remediate this issue.The fix above is the answer. These hold the line until you can deploy it, and are the only option on lines that get no fix.
What vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP
Bulletin ID: 2026-139-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:15 AM PDT
Description:
FreeRTOS-Plus-TCP is an open-source, thread-safe TCP/IP stack for the FreeRTOS kernel, distributed by Amazon for use on embedded and IoT devices. AWS identified two issues with FreeRTOS-Plus-TCP, affecting multiple versions.
CVE-2026-102551: improper verification of the source of a communication channel in the IPv6 Router Advertisement handler. The handler does not fully validate that a received Router Advertisement originates from an on-link source before acting on it. Under certain conditions, a remote third-party might influence an endpoint's IPv6 gateway, prefix, and address configuration, potentially enabling interception of the device's IPv6 traffic. This issue is reachable in the library's default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled.
CVE-2026-102552: improper verification of the source of a communication channel in the DNS resolver. The resolver does not fully validate that a DNS reply originates from the server that was queried before accepting it. Under certain conditions, a remote third-party might insert a chosen address into the device's DNS cache, potentially redirecting the device's subsequent connections for the affected name.
Impacted versions:
Resolution:
This issue has been addressed in FreeRTOS-Plus-TCP version V4.4.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
For the DNS resolver issue, responder source-IP validation is provided as an opt-in option and is disabled by default; upgrading alone does not remediate it. To remediate, upgrade to V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h.
Workarounds:
References:
Acknowledgement:
We would like to thank Cipher / Causal Security for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-102552")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.