8.1 CVE-2026-7424

Enriched by CISA
 

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service (permanent IP task freeze requiring hardware reset) by sending a single crafted DHCPv6 packet. The issue is present whenever DHCPv6 is enabled. To mitigate this issue, users should upgrade to version V4.2.6 or V4.4.1 or newer.
https://nvd.nist.gov/vuln/detail/CVE-2026-7424

Categories

CWE-191 : Integer Underflow (Wrap or Wraparound)
This can happen in signed and unsigned cases.

References


 

AFFECTED (from MITRE)

Vendor Product Versions
AWS FreeRTOS-Plus-TCP
  • 4.0.0 < 4.2.6 [affected]
  • 4.3.0 < 4.4.1 [affected]
  • 4.2.6 [unaffected]
  • 4.4.1 [unaffected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe start end
Configuration 1
cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:* >= 4.0.0 < 4.2.6
cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:* >= 4.3.0 < 4.4.1

REMEDIATION


EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
No entry