CVE-2026-102551
7.7HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-940
Impact
Remote attackers can hijack an endpoint's network traffic by poisoning its IPv6 default gateway, on-link prefix, and address settings. Exploitation requires sending crafted IPv6 Router Advertisements over the local network.
Root cause
The IPv6 Router Advertisement handler fails to properly verify the source of incoming router advertisement messages.
Affected systems
Amazon FreeRTOS-Plus-TCP before V4.4.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Fix & remediation
Upgrade the FreeRTOS-Plus-TCP component to version V4.4.2 or later. If upgrading immediately is not possible, disable IPv6 router advertisements or restrict untrusted traffic on the local network segment.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement. To remediate this issue, users should upgrade to version V4.4.2.