High severity7.7NVD Advisory· Published Oct 16, 2026

CVE-2026-102551

Description

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.

To remediate this issue, users should upgrade to version V4.4.2.

Affected products

Amazon/Freertos Plus TCPllm-fuzzy
Range: <4.4.2
FreeRTOS/Freertos Plus TCPllm-fuzzy
Range: <4.4.2

Patches

Vulnerability mechanics

References

aws.amazon.com/security/security-bulletins/2026-139-aws/nvd
github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.2nvd
github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-pjq5-fqrr-g6pvnvd

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000