{"id":"GHSA-h4fw-pv82-p7h5","kind":"vulnerability","aliases":["GHSA-h4fw-pv82-p7h5"],"related":[],"title":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP","description":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\n### CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\nBulletin ID: 2026-139-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:15 AM PDT\n\nDescription:\n\nFreeRTOS-Plus-TCP is an open-source, thread-safe TCP/IP stack for the FreeRTOS kernel, distributed by Amazon for use on embedded and IoT devices. AWS identified two issues with FreeRTOS-Plus-TCP, affecting multiple versions.\n\nCVE-2026-102551: improper verification of the source of a communication channel in the IPv6 Router Advertisement handler. The handler does not fully validate that a received Router Advertisement originates from an on-link source before acting on it. Under certain conditions, a remote third-party might influence an endpoint's IPv6 gateway, prefix, and address configuration, potentially enabling interception of the device's IPv6 traffic. This issue is reachable in the library's default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled.\n\nCVE-2026-102552: improper verification of the source of a communication channel in the DNS resolver. The resolver does not fully validate that a DNS reply originates from the server that was queried before accepting it. Under certain conditions, a remote third-party might insert a chosen address into the device's DNS cache, potentially redirecting the device's subsequent connections for the affected name.\n\nImpacted versions:\n\n- CVE-2026-102551 (Router Advertisement): <= V4.4.1\n- CVE-2026-102552 (DNS resolver): <= V4.4.1\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Plus-TCP version V4.4.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nFor the DNS resolver issue, responder source-IP validation is provided as an opt-in option and is disabled by default; upgrading alone does not remediate it. To remediate, upgrade to V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h.\n\nWorkarounds:\n\n- CVE-2026-102551 (Router Advertisement): If upgrading is not immediately possible, disable IPv6 Router Advertisement processing by setting ipconfigUSE_RA to ipconfigDISABLE (or disable IPv6 entirely with ipconfigUSE_IPv6 = ipconfigDISABLE) in FreeRTOSIPConfig.h where the device does not require IPv6 RA-based autoconfiguration. On the network side, deploying RA Guard and/or SEND on the local link mitigates the on-link vector but does not address the off-link vector reachable during lease-renewal windows.\n- CVE-2026-102552 (DNS resolver): There is no configuration-only workaround on affected versions, because responder source-IP validation does not exist prior to V4.4.2. Where feasible, restricting the device to a trusted local resolver and protecting the local network path reduces unintended access to off-path reply forgery but does not eliminate the issue.\n\nReferences:\n\n- CVE-2026-102551\n- CVE-2026-102552\n- GHSA-pjq5-fqrr-g6pv\n- GHSA-h4fw-pv82-p7h5\n\nAcknowledgement:\n\nWe would like to thank Cipher / Causal Security for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"FreeRTOS-Plus-TCP accepts IPv6 Router Advertisements from off-link sources and accepts DNS replies without checking they came from the queried server. A remote attacker can change an embedded device's IPv6 gateway and prefix, or insert a chosen address into its DNS cache, to intercept or redirect its traffic.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","dns","embedded","freertos","iot","ipv6","lab-disclosure","package"],"not_affected_if":["ipv6-disabled-and-ra-disabled","version-4.4.2-or-later"],"how_to_check":"- Check the FreeRTOS-Plus-TCP version in the project, which must be `V4.4.2` or later to be fixed.\n- Check `FreeRTOSIPConfig.h` for `ipconfigUSE_IPv6` and `ipconfigUSE_RA` set to `ipconfigENABLE`, and for `ipconfigDNS_CHECK_REPLY_SOURCE_IP` being set.","fix":"- Upgrade FreeRTOS-Plus-TCP to `V4.4.2` and patch any forked or derivative copies.\n- For the DNS issue, also enable `ipconfigDNS_CHECK_REPLY_SOURCE_IP` in `FreeRTOSIPConfig.h`, since upgrading alone does not fix it.\n- If upgrading is not immediately possible, set `ipconfigUSE_RA` to `ipconfigDISABLE` where IPv6 RA autoconfiguration is not needed; there is no configuration-only workaround for the DNS issue.","status":"open","published_at":"2026-10-16T00:00:00+00:00","first_seen_at":"2026-10-24T18:56:55+00:00","triaged_at":"2026-10-25T05:27:47+00:00","updated_at":"2026-10-25T05:27:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:27:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeRTOS-Plus-TCP to `V4.4.2` and patch any forked or derivative copies.\n- For the DNS issue, also enable `ipconfigDNS_CHECK_REPLY_SOURCE_IP` in `FreeRTOSIPConfig.h`, since upgrading alone does not fix it.\n- If upgrading is not immediately possible, set `ipconfigUSE_RA` to `ipconfigDISABLE` where IPv6 RA autoconfiguration is not needed; there is no configuration-only workaround for the DNS issue.","reach":"network","title":"FreeRTOS-Plus-TCP: spoofed router and DNS replies can redirect device traffic","impact":"medium","summary":"FreeRTOS-Plus-TCP accepts IPv6 Router Advertisements from off-link sources and accepts DNS replies without checking they came from the queried server. A remote attacker can change an embedded device's IPv6 gateway and prefix, or insert a chosen address into its DNS cache, to intercept or redirect its traffic.","category":"package","nicknames":[],"who_cares":["freertos","embedded","iot","ipv6","dns"],"confidence":0.8,"needs_auth":"no","worst_case":"Device traffic is intercepted or redirected to attacker-chosen addresses","analyst_note":"Check the AWS bulletin 2026-139-AWS and the GHSA-pjq5-fqrr-g6pv advisory for affected version ranges and whether the DNS check is part of the fix.","how_to_check":"- Check the FreeRTOS-Plus-TCP version in the project, which must be `V4.4.2` or later to be fixed.\n- Check `FreeRTOSIPConfig.h` for `ipconfigUSE_IPv6` and `ipconfigUSE_RA` set to `ipconfigENABLE`, and for `ipconfigDNS_CHECK_REPLY_SOURCE_IP` being set.","needs_analyst":true,"not_affected_if":["version-4.4.2-or-later","ipv6-disabled-and-ra-disabled"],"who_is_affected":"Embedded and IoT devices built on FreeRTOS-Plus-TCP at version V4.4.1 or earlier. The Router Advertisement issue is reachable in the default configuration where IPv6 and RA are enabled, while the DNS issue applies to any device that resolves names with the library's resolver. Devices that do not use this library, or run a newer version with the DNS check enabled, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000914,"input_tokens":4579,"output_tokens":913,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-102551':3A,88C,100C,172C,327C,417C,553C '-102552':6A,91C,103C,259C,333C,494C,556C '-139':113C '-2026':2A,5A,87C,90C,99C,102C,171C,258C,326C,332C,416C,493C,552C,555C '10':125C '10/16/2026':124C '15':126C '2026':112C 'accept':37B,47B,291C 'access':537C 'acknowledg':567C 'act':207C 'address':75B,227C,305C,342C,480C 'advertis':40B,186C,198C,329C,419C,429C 'affect':167C,321C,505C 'alon':395C 'amazon':150C 'and/or':465C 'attack':60B 'attent':121C 'autoconfigur':457C 'aw':23B,114C,116C,158C 'aws-security@amazon.com':589C 'base':456C 'bulletin':110C 'cach':79B,311C 'came':53B 'causal':574C 'certain':211C,294C 'chang':62B 'channel':181C,268C 'check':51B,408C 'chosen':74B,304C 'cipher':573C 'code':363C 'collabor':577C 'communic':180C,267C 'concern':595C 'condit':212C,295C 'configur':228C,247C,501C 'configuration-on':500C 'connect':318C 'content':117C 'coordin':583C 'cve':1A,4A,86C,89C,98C,101C,170C,257C,325C,331C,415C,492C,551C,554C 'date':123C 'default':246C,393C 'deploy':462C 'deriv':362C 'descript':129C 'devic':65B,157C,234C,308C,315C,449C,523C 'disabl':391C,426C,438C 'disclosur':31B,585C 'distribut':148C 'dns':24B,48B,78B,271C,281C,310C,334C,373C,495C 'elimin':547C 'email':588C 'embed':25B,64B,154C 'enabl':230C,256C,406C 'endpoint':221C 'ensur':358C 'entir':440C 'exist':515C 'feasibl':520C 'fix':370C 'forgeri':543C 'fork':360C 'fqrr':560C 'freerto':10A,26B,34B,95C,107C,131C,146C,164C,345C 'freertos-plus-tcp':9A,33B,94C,106C,130C,163C,344C 'freertosipconfig.h':413C,446C 'fulli':192C,277C 'g6pv':561C 'gateway':68B,224C 'ghsa':14A,19A,558C,563C 'ghsa-h4fw-pv82-p7h5':13A,18A,562C 'ghsa-pjq5-fqrr-g6pv':557C 'guard':464C 'h4fw':15A,20A,564C 'handler':187C,189C 'id':111C 'identifi':159C 'immedi':424C 'impact':323C 'import':119C 'improp':173C,260C 'incorpor':367C 'influenc':219C 'insert':72B,302C 'intercept':81B,231C 'iot':27B,156C 'ip':379C,411C,511C 'ipconfigdis':436C,444C 'ipconfigdn':407C 'ipconfigus':249C,252C,433C,442C 'ipv6':28B,38B,67B,184C,223C,236C,250C,427C,439C,443C,453C 'issu':7A,92C,104C,161C,239C,339C,375C,549C,580C 'kernel':147C 'lab':30B 'lab-disclosur':29B 'latest':355C 'leas':489C 'lease-renew':488C 'librari':244C 'like':570C 'link':44B,204C,470C,475C,484C 'local':469C,527C,532C 'might':218C,301C 'mitig':471C 'multipl':168C 'name':322C 'network':460C,533C 'new':369C 'off-link':42B,482C 'off-path':539C 'on-link':202C,473C 'open':137C 'open-sourc':136C 'opt':386C 'opt-in':385C 'option':388C 'origin':199C,283C 'p7h5':17A,22A,566C 'packag':32B 'parti':217C,300C 'patch':365C 'path':534C,541C 'pdt':128C 'pjq5':559C 'pleas':587C 'plus':11A,35B,96C,108C,132C,165C,346C 'possibl':425C 'potenti':229C,312C 'prefix':70B,225C 'prior':516C 'process':430C,586C 'protect':530C 'provid':382C 'public':122C 'pv82':16A,21A,565C 'queri':56B,289C 'question':593C 'ra':253C,434C,455C,463C 'ra-bas':454C 'reachabl':241C,486C 'receiv':196C 'recommend':351C 'redirect':83B,313C 'reduc':535C 'refer':550C 'remedi':398C,401C 'remot':59B,214C,297C 'renew':490C 'repli':49B,282C,409C,542C 'requir':120C,452C 'resolut':337C 'resolv':272C,274C,335C,374C,496C,528C 'respond':376C,508C 'restrict':521C 'router':39B,185C,197C,328C,418C,428C 'safe':141C 'scope':115C 'secur':575C,592C 'send':466C 'server':57B,286C 'set':432C 'side':461C 'sourc':45B,138C,177C,205C,264C,378C,410C,510C 'source-ip':377C,509C 'stack':143C 'subsequ':317C 'tcp':12A,36B,97C,109C,133C,166C,347C 'tcp/ip':142C 'thank':572C 'third':216C,299C 'third-parti':215C,298C 'thread':140C 'thread-saf':139C 'traffic':85B,237C 'trust':526C 'two':160C 'type':118C 'unintend':536C 'upgrad':352C,394C,402C,421C 'use':152C 'v4.4.1':330C,336C 'v4.4.2':349C,404C,518C 'valid':193C,278C,380C,512C 'vector':476C,485C 'verif':174C,261C 'version':169C,324C,348C,356C,506C 'vulner':584C 'window':491C 'without':50B 'workaround':414C,503C 'would':569C","nicknames":[],"mitigations":[],"who_affected":"Embedded and IoT devices built on FreeRTOS-Plus-TCP at version V4.4.1 or earlier. The Router Advertisement issue is reachable in the default configuration where IPv6 and RA are enabled, while the DNS issue applies to any device that resolves names with the library's resolver. Devices that do not use this library, or run a newer version with the DNS check enabled, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/#GHSA-h4fw-pv82-p7h5","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/","severity":null,"published_at":"2026-10-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:55+00:00","fetched_at":"2026-10-24T18:56:55+00:00","note":"AWS: CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP"}],"documents":[{"id":2916,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-139-aws/","title":"AWS: CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP","kind":"advisory","source":"lab","text":"CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\n### CVE-2026-102551 & CVE-2026-102552 - Issue with FreeRTOS-Plus-TCP\n\nBulletin ID: 2026-139-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:15 AM PDT\n\nDescription:\n\nFreeRTOS-Plus-TCP is an open-source, thread-safe TCP/IP stack for the FreeRTOS kernel, distributed by Amazon for use on embedded and IoT devices. AWS identified two issues with FreeRTOS-Plus-TCP, affecting multiple versions.\n\nCVE-2026-102551: improper verification of the source of a communication channel in the IPv6 Router Advertisement handler. The handler does not fully validate that a received Router Advertisement originates from an on-link source before acting on it. Under certain conditions, a remote third-party might influence an endpoint's IPv6 gateway, prefix, and address configuration, potentially enabling interception of the device's IPv6 traffic. This issue is reachable in the library's default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled.\n\nCVE-2026-102552: improper verification of the source of a communication channel in the DNS resolver. The resolver does not fully validate that a DNS reply originates from the server that was queried before accepting it. Under certain conditions, a remote third-party might insert a chosen address into the device's DNS cache, potentially redirecting the device's subsequent connections for the affected name.\n\nImpacted versions:\n\n- CVE-2026-102551 (Router Advertisement): <= V4.4.1\n- CVE-2026-102552 (DNS resolver): <= V4.4.1\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Plus-TCP version V4.4.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nFor the DNS resolver issue, responder source-IP validation is provided as an opt-in option and is disabled by default; upgrading alone does not remediate it. To remediate, upgrade to V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h.\n\nWorkarounds:\n\n- CVE-2026-102551 (Router Advertisement): If upgrading is not immediately possible, disable IPv6 Router Advertisement processing by setting ipconfigUSE_RA to ipconfigDISABLE (or disable IPv6 entirely with ipconfigUSE_IPv6 = ipconfigDISABLE) in FreeRTOSIPConfig.h where the device does not require IPv6 RA-based autoconfiguration. On the network side, deploying RA Guard and/or SEND on the local link mitigates the on-link vector but does not address the off-link vector reachable during lease-renewal windows.\n- CVE-2026-102552 (DNS resolver): There is no configuration-only workaround on affected versions, because responder source-IP validation does not exist prior to V4.4.2. Where feasible, restricting the device to a trusted local resolver and protecting the local network path reduces unintended access to off-path reply forgery but does not eliminate the issue.\n\nReferences:\n\n- CVE-2026-102551\n- CVE-2026-102552\n- GHSA-pjq5-fqrr-g6pv\n- GHSA-h4fw-pv82-p7h5\n\nAcknowledgement:\n\nWe would like to thank Cipher / Causal Security for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-16T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}