Amazon FreeRTOS-Plus-TCP: DNS cache poisoning via spoofed DNS replies
Summary
FreeRTOS-Plus-TCP, a TCP/IP stack used in embedded and IoT devices, does not fully verify that a DNS reply comes from the server that was queried. A remote attacker who forges a DNS reply can insert an attacker-chosen address into the device's DNS cache and redirect its subsequent connections for the affected name. The attacker must be able to inject forged replies, typically from the local network or path, and no authentication or user interaction is required.
Affected
- FreeRTOS-Plus-TCP versions 0 to 4.4.1 (up to and including V4.4.1)
Fixed in
- Version V4.4.2, with ipconfigDNS_CHECK_REPLY_SOURCE_IP enabled in FreeRTOSIPConfig.h (the option is disabled by default)
Workaround
- No configuration-only workaround exists for affected versions, because responder source-IP validation is not available before V4.4.2.
- Where feasible, restrict the device to a trusted local resolver and protect the local network path to reduce exposure. This does not eliminate the issue.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact partial.
- No public proof of concept found; this is not confirmation that none exists.
Our recommendation
- Inventory devices and firmware that use FreeRTOS-Plus-TCP; ask device vendors whether their firmware includes it.
- Ask vendors for firmware updates that include V4.4.2 or later; upgrading the library alone is not enough.
- Enable ipconfigDNS_CHECK_REPLY_SOURCE_IP after upgrading and test it first, because reviewer comments on a related pull request report that it may reject some legitimate LLMNR and mDNS responses.
- Patch CVE-2026-102551 (IPv6 Router Advertisement) at the same time, since it affects the same versions.
- Limit network access to affected devices and monitor for unexpected DNS behaviour.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-139-AWS aws.amazon.com
- FreeRTOS-Plus-TCP Release V4.4.2 github.com
- GitHub Security Advisory GHSA-h4fw-pv82-p7h5 github.com
- OSV entry CVE-2026-102552 osv.dev
- Vulners CVE listing CVE-2026-102552 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:53.
Original description (NVD)
Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.