{"id":"CVE-2026-102551","summary":"Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling","details":"Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.\n\n\n\nTo remediate this issue, users should upgrade to version V4.4.2.","aliases":["GHSA-pjq5-fqrr-g6pv"],"modified":"2026-10-17T02:47:51.406584570Z","published":"2026-10-16T17:27:38.483Z","database_specific":{"cna_assigner":"AMZN","cwe_ids":["CWE-940"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102551.json"},"references":[{"type":"ADVISORY","url":"https://aws.amazon.com/security/security-bulletins/2026-139-aws/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102551.json"},{"type":"FIX","url":"https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.2"},{"type":"ADVISORY","url":"https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-pjq5-fqrr-g6pv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102551"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freertos/freertos-plus-tcp","events":[{"introduced":"0"},{"last_affected":"c12361095aca68aeed858f45d14395fbffa92c0d"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"4.4.1"}]}}],"versions":["V4.4.1","V4.4.0","V4.0.0-appsec","V2.4.0","V2.3.4","V2.3.2","V2.3.3","V2.3.1","V2.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102551.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"}]}