CVE-2026-7422 affects AWS FreeRTOS-Plus-TCP prior to versions 4.2.6 and 4.4.1. The vulnerability stems from a flaw in packet validation where the loopback detection mechanism skips input validation for packets whose Ethernet source MAC address matches a local endpoint. An adjacent network actor can exploit this by spoofing the source MAC address to bypass authentication checks, specifically checksum and minimum-size validations. This results in an authentication bypass vulnerability categorized under CWE-290. AWS provides a patch for this issue and manages remediation for this cloud service.

The vulnerability allows an adjacent network attacker to bypass authentication by spoofing the Ethernet source MAC address, potentially enabling unauthorized network interactions that bypass checksum and minimum-size validations. However, there is no confidentiality impact reported, and no known exploits exist in the wild at this time. The CVSS score of 6.5 reflects a medium severity impact primarily due to integrity concerns without direct impact on confidentiality or availability.

AWS manages remediation for this cloud-hosted service. Users should upgrade to AWS FreeRTOS-Plus-TCP versions 4.2.6 or 4.4.1 or later when available to address this vulnerability. Check the AWS security advisory at https://aws.amazon.com/security/security-bulletins/2026-021-aws/ for the latest patch and remediation guidance. Since this is a cloud service, AWS typically applies patches server-side, but users should verify their device firmware versions and update accordingly.