{"id":"CVE-2026-102552","kind":"vulnerability","aliases":["CVE-2026-102552"],"related":[],"title":"FreeRTOS-Plus-TCP: forged DNS replies can poison the device's DNS cache","description":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\n### CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\nBulletin ID: 2026-139-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:15 AM PDT\n\nDescription:\n\nFreeRTOS-Plus-TCP is an open-source, thread-safe TCP/IP stack for the FreeRTOS kernel, distributed by Amazon for use on embedded and IoT devices. AWS identified two issues with FreeRTOS-Plus-TCP, affecting multiple versions.\n\nCVE-2026-102551: improper verification of the source of a communication channel in the IPv6 Router Advertisement handler. The handler does not fully validate that a received Router Advertisement originates from an on-link source before acting on it. Under certain conditions, a remote third-party might influence an endpoint's IPv6 gateway, prefix, and address configuration, potentially enabling interception of the device's IPv6 traffic. This issue is reachable in the library's default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled.\n\nCVE-2026-102552: improper verification of the source of a communication channel in the DNS resolver. The resolver does not fully validate that a DNS reply originates from the server that was queried before accepting it. Under certain conditions, a remote third-party might insert a chosen address into the device's DNS cache, potentially redirecting the device's subsequent connections for the affected name.\n\nImpacted versions:\n\n- CVE-2026-102551 (Router Advertisement): <= V4.4.1\n- CVE-2026-102552 (DNS resolver): <= V4.4.1\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Plus-TCP version V4.4.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nFor the DNS resolver issue, responder source-IP validation is provided as an opt-in option and is disabled by default; upgrading alone does not remediate it. To remediate, upgrade to V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h.\n\nWorkarounds:\n\n- CVE-2026-102551 (Router Advertisement): If upgrading is not immediately possible, disable IPv6 Router Advertisement processing by setting ipconfigUSE_RA to ipconfigDISABLE (or disable IPv6 entirely with ipconfigUSE_IPv6 = ipconfigDISABLE) in FreeRTOSIPConfig.h where the device does not require IPv6 RA-based autoconfiguration. On the network side, deploying RA Guard and/or SEND on the local link mitigates the on-link vector but does not address the off-link vector reachable during lease-renewal windows.\n- CVE-2026-102552 (DNS resolver): There is no configuration-only workaround on affected versions, because responder source-IP validation does not exist prior to V4.4.2. Where feasible, restricting the device to a trusted local resolver and protecting the local network path reduces unintended access to off-path reply forgery but does not eliminate the issue.\n\nReferences:\n\n- CVE-2026-102551\n- CVE-2026-102552\n- GHSA-pjq5-fqrr-g6pv\n- GHSA-h4fw-pv82-p7h5\n\nAcknowledgement:\n\nWe would like to thank Cipher / Causal Security for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"FreeRTOS-Plus-TCP's DNS resolver accepts a reply without checking that it came from the server that was queried. A remote third party can insert a chosen address into the device's DNS cache and redirect its later connections for that name.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","embedded","freertos","freertos-plus-tcp","iot","lab-disclosure","package"],"not_affected_if":["no-dns-resolution","version-4.4.2-with-source-ip-check"],"how_to_check":"- Check the FreeRTOS-Plus-TCP version in the project, which is affected at `<= V4.4.1`.\n- Check whether `ipconfigDNS_CHECK_REPLY_SOURCE_IP` is defined and enabled in `FreeRTOSIPConfig.h`.","fix":"- Upgrade FreeRTOS-Plus-TCP to `V4.4.2` and patch any forked or derivative code.\n- Set `ipconfigDNS_CHECK_REPLY_SOURCE_IP` to enabled in `FreeRTOSIPConfig.h`; upgrading alone does not remediate this issue.\n- No configuration-only workaround exists on affected versions; restricting the device to a trusted local resolver and protecting the local network path reduces but does not eliminate the risk.","status":"open","published_at":"2026-10-16T00:00:00+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:04:31+00:00","updated_at":"2026-10-25T03:04:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:04:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeRTOS-Plus-TCP to `V4.4.2` and patch any forked or derivative code.\n- Set `ipconfigDNS_CHECK_REPLY_SOURCE_IP` to enabled in `FreeRTOSIPConfig.h`; upgrading alone does not remediate this issue.\n- No configuration-only workaround exists on affected versions; restricting the device to a trusted local resolver and protecting the local network path reduces but does not eliminate the risk.","reach":"network","title":"FreeRTOS-Plus-TCP: forged DNS replies can poison the device's DNS cache","impact":"high","summary":"FreeRTOS-Plus-TCP's DNS resolver accepts a reply without checking that it came from the server that was queried. A remote third party can insert a chosen address into the device's DNS cache and redirect its later connections for that name.","category":"package","nicknames":[],"who_cares":["embedded","iot","freertos","freertos-plus-tcp"],"confidence":0.8,"needs_auth":"no","worst_case":"Device traffic redirected to attacker-chosen addresses through poisoned DNS cache","analyst_note":"","how_to_check":"- Check the FreeRTOS-Plus-TCP version in the project, which is affected at `<= V4.4.1`.\n- Check whether `ipconfigDNS_CHECK_REPLY_SOURCE_IP` is defined and enabled in `FreeRTOSIPConfig.h`.","needs_analyst":false,"not_affected_if":["version-4.4.2-with-source-ip-check","no-dns-resolution"],"who_is_affected":"Embedded and IoT devices that build FreeRTOS-Plus-TCP at version `<= V4.4.1` and resolve DNS names, including forks and derivative code. The risk is greatest where the device sends DNS queries across networks an attacker can reach; devices on a fully trusted local resolver path face less exposure. Teams on `V4.4.2` with source-IP checking enabled can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000832,"input_tokens":4603,"output_tokens":743,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102551':79C,91C,163C,318C,408C,544C '-102552':17A,20A,82C,94C,250C,324C,485C,547C '-139':104C '-2026':16A,19A,78C,81C,90C,93C,162C,249C,317C,323C,407C,484C,543C,546C '10':116C '10/16/2026':115C '15':117C '2026':103C 'accept':40B,282C 'access':528C 'acknowledg':558C 'act':198C 'address':62B,218C,296C,333C,471C 'advertis':177C,189C,320C,410C,420C 'affect':158C,312C,496C 'alon':386C 'amazon':141C 'and/or':456C 'attent':112C 'autoconfigur':448C 'aw':21B,105C,107C,149C 'aws-security@amazon.com':580C 'base':447C 'bulletin':101C 'cach':14A,68B,302C 'came':47B 'causal':565C 'certain':202C,285C 'channel':172C,259C 'check':44B,399C 'chosen':61B,295C 'cipher':564C 'code':354C 'collabor':568C 'communic':171C,258C 'concern':586C 'condit':203C,286C 'configur':219C,238C,492C 'configuration-on':491C 'connect':73B,309C 'content':108C 'coordin':574C 'cve':15A,18A,77C,80C,89C,92C,161C,248C,316C,322C,406C,483C,542C,545C 'date':114C 'default':237C,384C 'deploy':453C 'deriv':353C 'descript':120C 'devic':11A,65B,148C,225C,299C,306C,440C,514C 'disabl':382C,417C,429C 'disclosur':31B,576C 'distribut':139C 'dns':6A,13A,38B,67B,262C,272C,301C,325C,364C,486C 'elimin':538C 'email':579C 'embed':22B,145C 'enabl':221C,247C,397C 'endpoint':212C 'ensur':349C 'entir':431C 'exist':506C 'feasibl':511C 'fix':361C 'forg':5A 'forgeri':534C 'fork':351C 'fqrr':551C 'freerto':2A,23B,25B,34B,86C,98C,122C,137C,155C,336C 'freertos-plus-tcp':1A,24B,33B,85C,97C,121C,154C,335C 'freertosipconfig.h':404C,437C 'fulli':183C,268C 'g6pv':552C 'gateway':215C 'ghsa':549C,554C 'ghsa-h4fw-pv82-p7h5':553C 'ghsa-pjq5-fqrr-g6pv':548C 'guard':455C 'h4fw':555C 'handler':178C,180C 'id':102C 'identifi':150C 'immedi':415C 'impact':314C 'import':110C 'improp':164C,251C 'incorpor':358C 'influenc':210C 'insert':59B,293C 'intercept':222C 'iot':28B,147C 'ip':370C,402C,502C 'ipconfigdis':427C,435C 'ipconfigdn':398C 'ipconfigus':240C,243C,424C,433C 'ipv6':175C,214C,227C,241C,418C,430C,434C,444C 'issu':83C,95C,152C,230C,330C,366C,540C,571C 'kernel':138C 'lab':30B 'lab-disclosur':29B 'later':72B 'latest':346C 'leas':480C 'lease-renew':479C 'librari':235C 'like':561C 'link':195C,461C,466C,475C 'local':460C,518C,523C 'might':209C,292C 'mitig':462C 'multipl':159C 'name':76B,313C 'network':451C,524C 'new':360C 'off-link':473C 'off-path':530C 'on-link':193C,464C 'open':128C 'open-sourc':127C 'opt':377C 'opt-in':376C 'option':379C 'origin':190C,274C 'p7h5':557C 'packag':32B 'parti':57B,208C,291C 'patch':356C 'path':525C,532C 'pdt':119C 'pjq5':550C 'pleas':578C 'plus':3A,26B,35B,87C,99C,123C,156C,337C 'poison':9A 'possibl':416C 'potenti':220C,303C 'prefix':216C 'prior':507C 'process':421C,577C 'protect':521C 'provid':373C 'public':113C 'pv82':556C 'queri':53B,280C 'question':584C 'ra':244C,425C,446C,454C 'ra-bas':445C 'reachabl':232C,477C 'receiv':187C 'recommend':342C 'redirect':70B,304C 'reduc':526C 'refer':541C 'remedi':389C,392C 'remot':55B,205C,288C 'renew':481C 'repli':7A,42B,273C,400C,533C 'requir':111C,443C 'resolut':328C 'resolv':39B,263C,265C,326C,365C,487C,519C 'respond':367C,499C 'restrict':512C 'router':176C,188C,319C,409C,419C 'safe':132C 'scope':106C 'secur':566C,583C 'send':457C 'server':50B,277C 'set':423C 'side':452C 'sourc':129C,168C,196C,255C,369C,401C,501C 'source-ip':368C,500C 'stack':134C 'subsequ':308C 'tcp':4A,27B,36B,88C,100C,124C,157C,338C 'tcp/ip':133C 'thank':563C 'third':56B,207C,290C 'third-parti':206C,289C 'thread':131C 'thread-saf':130C 'traffic':228C 'trust':517C 'two':151C 'type':109C 'unintend':527C 'upgrad':343C,385C,393C,412C 'use':143C 'v4.4.1':321C,327C 'v4.4.2':340C,395C,509C 'valid':184C,269C,371C,503C 'vector':467C,476C 'verif':165C,252C 'version':160C,315C,339C,347C,497C 'vulner':575C 'window':482C 'without':43B 'workaround':405C,494C 'would':560C","nicknames":[],"mitigations":[{"kind":"workaround","scope":"FreeRTOS-Plus-TCP DNS resolver","since":null,"covers":"Restricting the device to a trusted local resolver and protecting the local network path","limits":"Reduces but does not eliminate off-path reply forgery; no configuration-only workaround exists before V4.4.2","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/","vendor":"Team","seen_at":"2026-10-24T18:56:52Z","confidence":0.7,"source_title":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP","customer_action":"Where feasible, restrict the device to a trusted local DNS resolver and protect the local network path until upgrading to V4.4.2"},{"kind":"config","scope":null,"since":"2026-10-16","covers":"DNS resolver in FreeRTOS-Plus-TCP: responder source-IP validation for DNS replies once enabled with ipconfigDNS_CHECK_REPLY_SOURCE_IP in V4.4.2","limits":"Disabled by default and not remediated by upgrading alone; the affected versions have no such option before V4.4.2","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/","vendor":"AWS","seen_at":"2026-10-24T18:56:52Z","confidence":0.95,"source_title":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP","customer_action":"Upgrade to FreeRTOS-Plus-TCP V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h"}],"who_affected":"Embedded and IoT devices that build FreeRTOS-Plus-TCP at version `<= V4.4.1` and resolve DNS names, including forks and derivative code. The risk is greatest where the device sends DNS queries across networks an attacker can reach; devices on a fully trusted local resolver path face less exposure. Teams on `V4.4.2` with source-IP checking enabled can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102552","severity":null,"published_at":"2026-10-16T18:17:14+00:00","modified_at":"2026-10-19T13:16:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/#CVE-2026-102552","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/","severity":null,"published_at":"2026-10-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:55+00:00","fetched_at":"2026-10-24T18:56:55+00:00","note":"AWS: CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP"}],"documents":[{"id":2916,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/","title":"AWS: CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP","kind":"advisory","source":"lab","text":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\n### CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\nBulletin ID: 2026-139-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:15 AM PDT\n\nDescription:\n\nFreeRTOS-Plus-TCP is an open-source, thread-safe TCP/IP stack for the FreeRTOS kernel, distributed by Amazon for use on embedded and IoT devices. AWS identified two issues with FreeRTOS-Plus-TCP, affecting multiple versions.\n\nCVE-2026-102551: improper verification of the source of a communication channel in the IPv6 Router Advertisement handler. The handler does not fully validate that a received Router Advertisement originates from an on-link source before acting on it. Under certain conditions, a remote third-party might influence an endpoint's IPv6 gateway, prefix, and address configuration, potentially enabling interception of the device's IPv6 traffic. This issue is reachable in the library's default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled.\n\nCVE-2026-102552: improper verification of the source of a communication channel in the DNS resolver. The resolver does not fully validate that a DNS reply originates from the server that was queried before accepting it. Under certain conditions, a remote third-party might insert a chosen address into the device's DNS cache, potentially redirecting the device's subsequent connections for the affected name.\n\nImpacted versions:\n\n- CVE-2026-102551 (Router Advertisement): <= V4.4.1\n- CVE-2026-102552 (DNS resolver): <= V4.4.1\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Plus-TCP version V4.4.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nFor the DNS resolver issue, responder source-IP validation is provided as an opt-in option and is disabled by default; upgrading alone does not remediate it. To remediate, upgrade to V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h.\n\nWorkarounds:\n\n- CVE-2026-102551 (Router Advertisement): If upgrading is not immediately possible, disable IPv6 Router Advertisement processing by setting ipconfigUSE_RA to ipconfigDISABLE (or disable IPv6 entirely with ipconfigUSE_IPv6 = ipconfigDISABLE) in FreeRTOSIPConfig.h where the device does not require IPv6 RA-based autoconfiguration. On the network side, deploying RA Guard and/or SEND on the local link mitigates the on-link vector but does not address the off-link vector reachable during lease-renewal windows.\n- CVE-2026-102552 (DNS resolver): There is no configuration-only workaround on affected versions, because responder source-IP validation does not exist prior to V4.4.2. Where feasible, restricting the device to a trusted local resolver and protecting the local network path reduces unintended access to off-path reply forgery but does not eliminate the issue.\n\nReferences:\n\n- CVE-2026-102551\n- CVE-2026-102552\n- GHSA-pjq5-fqrr-g6pv\n- GHSA-h4fw-pv82-p7h5\n\nAcknowledgement:\n\nWe would like to thank Cipher / Causal Security for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-16T00:00:00+00:00","relation":"advisory","confidence":null,"note":"AWS disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}