CVE-2026-7422
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.
Risk Assessment
An attacker on the same network can send malicious packets without validation, potentially leading to device crash or takeover. The risk affects devices running the vulnerable TCP stack version.
Recommendation
Update FreeRTOS-Plus-TCP to version V4.2.6 or V4.4.1 (or later). Until updated, consider network segmentation and monitoring for unusual traffic.
Other vulnerabilities in FreeRTOS-Plus-TCP
See all- CVE-2026-7426High
In FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1, there is insufficient validation of the prefix length field in IPv6 Router Advertisement processing. This allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid length, resulting in a heap buffer overflow.
- CVE-2026-7425Medium
Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option smaller than the expected structure size.
- CVE-2026-7424High
An integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times.
- CVE-2026-7423Medium
Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6. When outgoing ping support is enabled, header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB.
- CVE-2025-11618Medium
A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field. This issue only affects applications using IPv6.
- CVE-2025-11617Medium
A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving an IPv6 packet with incorrect payload lengths in the packet header. This issue only affects applications using IPv6.
- CVE-2025-11616Medium
A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. These issues only affect applications using IPv6.
Original NVD description (English source)
Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS