FreeRTOS-Plus-TCP: Improper source verification in IPv6 Router Advertisement handling
Summary
FreeRTOS-Plus-TCP, a TCP/IP stack for embedded and IoT devices, does not properly verify that IPv6 Router Advertisements come from an on-link source before acting on them. A remote attacker can send a crafted Router Advertisement to change the device's IPv6 default gateway, on-link prefix and address configuration, which may allow interception of its IPv6 traffic. The issue is reachable in the default configuration where IPv6 and Router Advertisement processing are enabled, and no authentication or user interaction is required according to the CVSS vector.
Affected
- FreeRTOS-Plus-TCP versions 0 to 4.4.1 (V4.4.1 and earlier)
- Older maintenance branches: Unknown.
Fixed in
- FreeRTOS-Plus-TCP V4.4.2
- Older maintenance branches: Unknown.
Workaround
- Disable Router Advertisement processing by setting ipconfigUSE_RA to ipconfigDISABLE in FreeRTOSIPConfig.h, or disable IPv6 with ipconfigUSE_IPv6 set to ipconfigDISABLE, where IPv6 RA autoconfiguration is not required.
- RA Guard and/or SEND on the local link mitigate the on-link attack vector only; they do not address the off-link vector during lease-renewal windows.
Exploitation
- Not marked as known exploited.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found; this does not prove none exists.
Our recommendation
- Ask device and equipment vendors whether their firmware includes FreeRTOS-Plus-TCP and when an update based on V4.4.2 is available.
- Check whether IPv6 and Router Advertisement processing are needed on these devices; if not, disable them as described above.
- Segment IoT and OT devices from the general office network to limit who can reach them on the same local segment.
- Monitor the AWS bulletin and the GHSA advisory for updates and exploit reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-139-AWS aws.amazon.com
- FreeRTOS-Plus-TCP Release V4.4.2 github.com
- GitHub Security Advisory GHSA-pjq5-fqrr-g6pv github.com
- VulDB entry 421359 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:21.
Original description (NVD)
Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement. To remediate this issue, users should upgrade to version V4.4.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.