Improper Communication Channel Verification in Amazon FreeRTOS-Plus-TCP
CVE-2026-102551

9.2CRITICAL

Key Information:

Vendor

Freertos

Status
Freertos-plus-tcp
Vendor
CVE Published:
16 October 2026

What is CVE-2026-102551?

A vulnerability in Amazon FreeRTOS-Plus-TCP allows remote third parties to potentially manipulate an endpoint's IPv6 configuration. Specifically, the improper verification in the IPv6 Router Advertisement handler before version V4.4.2 can enable unauthorized influence over the endpoint's default gateway and address settings via crafted Router Advertisements. Users are strongly advised to upgrade to version V4.4.2 to mitigate this security risk.

Affected Version(s)

FreeRTOS-Plus-TCP 0 <= 4.4.1

References

https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/ta...
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/ad...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Causal Security
.