Key points
- FreeRTOS-Plus-TCP versions through V4.4.1 contain two high-severity flaws.
- CVE-2026-102551 allows manipulation of IPv6 configuration via router advertisements.
- CVE-2026-102552 enables DNS cache poisoning by accepting replies from wrong sources.
Amazon Web Services released security bulletin 2026-139-AWS on October 16, 2026, addressing two vulnerabilities in FreeRTOS-Plus-TCP. The open-source TCP/IP stack is used in embedded and IoT devices. Both flaws affect versions up to and including V4.4.1. A fix is available in version V4.4.2, but specific configuration changes are required for full remediation.
In plain English
The first flaw, CVE-2026-102551, involves how the software handles IPv6 router advertisements. The handler does not fully verify that these messages come from a legitimate on-link source. An attacker could potentially influence the device's gateway and address settings, which might allow them to intercept IPv6 traffic. This issue is present in the default configuration if IPv6 and router advertisements are enabled.
The second flaw, CVE-2026-102552, affects the DNS resolver. It does not strictly check that a DNS reply comes from the server that was actually queried. A remote party could insert a fake address into the device's DNS cache. This could redirect the device's subsequent connections for that name to an attacker-controlled location.
The background
FreeRTOS-Plus-TCP is a thread-safe TCP/IP stack distributed by Amazon for use with the FreeRTOS kernel. It is widely used in embedded systems and Internet of Things devices. The vulnerabilities were identified through a coordinated disclosure process with Cipher and Causal Security. AWS rated the bulletin as important, requiring attention from users of the affected software versions.
What changes now
Users must upgrade to FreeRTOS-Plus-TCP version V4.4.2 to address both issues. However, simply upgrading is not enough for the DNS flaw. Teams must also enable the `ipconfigDNS_CHECK_REPLY_SOURCE_IP` option in the `FreeRTOSIPConfig.h` file. For the IPv6 issue, upgrading alone fixes the improper verification. If upgrading is not possible immediately, users can disable IPv6 router advertisement processing or IPv6 entirely in the configuration file, provided the device does not need autoconfiguration.
Who needs to act first
Teams should prioritize updating devices that are exposed to untrusted networks or public Wi-Fi. Systems handling sensitive data or operating in environments where attackers might inject network messages require immediate attention. Before rolling out the update, verify that the new version is compatible with existing firmware. Back up current configurations to allow for quick rollback if issues arise. Test the updated stack in a staging environment to ensure network connectivity remains stable. For devices that cannot be updated right away, restrict them to trusted local networks to reduce exposure to rogue router advertisements and DNS replies.
What to do and how to stay safe: FreeRTOS-Plus-TCP
- Upgrade FreeRTOS-Plus-TCP to version V4.4.2 on all affected embedded devices.
- Enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h to fix the DNS flaw.
- Disable IPv6 router advertisements by setting ipconfigUSE_RA to ipconfigDISABLE if upgrading is delayed.
- Monitor network traffic for unusual IPv6 configuration changes or unexpected DNS redirects.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of FreeRTOS-Plus-TCP are affected by these vulnerabilities?
Versions up to and including V4.4.1 are affected by both CVE-2026-102551 and CVE-2026-102552.
Is upgrading to V4.4.2 enough to fix both issues?
No. Upgrading fixes the IPv6 flaw, but you must also enable ipconfigDNS_CHECK_REPLY_SOURCE_IP to remediate the DNS resolver issue.
Can I disable the vulnerable features instead of upgrading?
Yes. For the IPv6 flaw, you can disable router advertisement processing or IPv6 entirely. There is no configuration workaround for the DNS flaw on older versions.
