CVE-2026-102551: CWE-940 Improper verification of source of a communication channel in FreeRTOS FreeRTOS-Plus-TCP

FreeRTOS-Plus-TCP contains a vulnerability identified as CVE-2026-102551 related to improper verification of the source of communication in the IPv6 Router Advertisement handler. The handler does not fully validate that a received Router Advertisement originates from an on-link source before acting on it. This allows a remote third party, under certain conditions, to influence the device's IPv6 network configuration, potentially enabling interception of IPv6 traffic. The vulnerability is present in the library's default configuration when ipconfigUSE_IPv6 and ipconfigUSE_RA are enabled. It affects FreeRTOS-Plus-TCP versions up to and including 4.4.1.

An attacker can manipulate the IPv6 Router Advertisement process to alter the device's IPv6 gateway, prefix, and address configuration. This could lead to interception of the device's IPv6 network traffic. The vulnerability impacts confidentiality and integrity of communications, with a low impact on availability. The CVSS 3.1 score is 7.7 (high severity), reflecting network attack vector, high impact on confidentiality and integrity, and low impact on availability.

The vendor advisory does not explicitly state patch availability or remediation status. Patch status is not yet confirmed — check the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-139-aws/ for current remediation guidance. Users should verify if updated versions or patches are available and apply them accordingly. Until a patch is applied, consider disabling IPv6 Router Advertisement handling if feasible to reduce exposure.