CVE-2026-7422

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-7422
Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://aws.amazon.com/security/security-bulletins/2026-021-aws/ Vendor Advisory
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6 Release Notes
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1 Release Notes
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-jpw4-6h59-62w9 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*
cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*
History

17 Jun 2026, 11:02

Type Values Removed Values Added
References () https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-jpw4-6h59-62w9 - Vendor Advisory, Patch () https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-jpw4-6h59-62w9 - Patch, Vendor Advisory

04 May 2026, 13:43

Type Values Removed Values Added
CPE cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*
References () https://aws.amazon.com/security/security-bulletins/2026-021-aws/ - () https://aws.amazon.com/security/security-bulletins/2026-021-aws/ - Vendor Advisory
References () https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6 - () https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6 - Release Notes
References () https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1 - () https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1 - Release Notes
References () https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-jpw4-6h59-62w9 - () https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-jpw4-6h59-62w9 - Vendor Advisory, Patch
First Time Amazon freertos-plus-tcp
Amazon

30 Apr 2026, 15:13

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-29 19:16

Updated : 2026-06-17 11:02

NVD link : CVE-2026-7422

Mitre link : CVE-2026-7422

CVE.ORG link : CVE-2026-7422

JSON object : View

Products Affected

amazon

  • freertos-plus-tcp
CWE
CWE-290

Authentication Bypass by Spoofing