HIGH🇬🇧 English

CVE-2026-7422

CVSS 7.1v4.0pub. 2026-04-29upd. 2026-05-04

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.

oryginał EN
CVSS Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Amazon Freertos Plus Tcp

    APP
    Amazon
    4.0.0 – 4.2.6 (bez)4.3.0 – 4.4.1 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2024-38373CRITICAL9.6PL ✓ten sam produkt

Buffer over-read w parserze DNS biblioteki FreeRTOS-Plus-TCP

CVE-2026-7424HIGH7.2ten sam produkt

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adja...

CVE-2026-7426MEDIUM6.1ten sam produkt

Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TC...

CVE-2026-7423MEDIUM6.0ten sam produkt

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 all...

CVE-2026-7425MEDIUM6.0ten sam produkt

Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2...