AWS fixes FreeRTOS-Plus-TCP flaws that let attackers hijack IoT traffic
Two vulnerabilities in the embedded network stack allow remote manipulation of IPv6 routing and DNS resolution, enabling traffic interception on affected devices.
Key points
- AWS identified source-verification failures in FreeRTOS-Plus-TCP versions up to V4.4.1.
- CVE-2026-102551 allows remote influence over IPv6 gateway and address configuration.
- CVE-2026-102552 permits insertion of chosen addresses into the device DNS cache.
Remote attackers can manipulate how embedded devices route network traffic and resolve domain names by exploiting two flaws in Amazon’s FreeRTOS-Plus-TCP stack. According to an AWS security bulletin published on October 16, 2026, these issues allow third parties to intercept IPv6 communications or redirect connections to chosen addresses without direct access to the device.
In plain English
The first flaw involves how the device handles IPv6 Router Advertisement messages. The software does not fully verify that these messages come from a legitimate on-link source. This gap lets an attacker influence the device’s gateway settings and address configuration, potentially allowing them to intercept IPv6 traffic flowing to or from the device.
The second flaw affects the DNS resolver. The system fails to confirm that a DNS reply originates from the specific server it queried. An attacker can insert a chosen address into the device’s cache, causing subsequent connections for that name to redirect to a location controlled by the attacker rather than the intended destination.
The background
FreeRTOS-Plus-TCP is an open-source, thread-safe TCP/IP stack distributed by Amazon for use on embedded and IoT devices running the FreeRTOS kernel. AWS identified these two issues across multiple versions of the library. The problems are reachable in the default configuration where IPv6 and Router Advertisement features are enabled, or where DNS resolution is active without source validation.
Cipher / Causal Security collaborated with AWS on the coordinated disclosure of these issues. The vulnerabilities affect versions up to and including V4.4.1. AWS rated the bulletin as important, requiring attention from teams managing devices that use this networking stack for their internet connectivity and local network communication.
What changes now
AWS has released FreeRTOS-Plus-TCP version V4.4.2 to address both vulnerabilities. Teams are advised to upgrade to this latest version and ensure any forked or derivative code incorporates the new fixes. For the DNS resolver issue, upgrading alone is insufficient because responder source-IP validation is an opt-in option disabled by default. Users must enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h.
For the Router Advertisement issue, if upgrading is not immediately possible, teams can disable IPv6 Router Advertisement processing by setting ipconfigUSE_RA to ipconfigDISABLE. Disabling IPv6 entirely with ipconfigUSE_IPv6 = ipconfigDISABLE is another option if the device does not require RA-based autoconfiguration. Network-side mitigations like RA Guard do not address the off-link vector.
What made it possible
Teams usually verify that network control messages originate from trusted, local sources before applying configuration changes. This incident highlights the risk of accepting unsolicited routing or resolution data without strict source validation. Attackers exploit this trust to poison device state, redirecting traffic for interception or data theft. Check whether your embedded systems validate the origin of all network control packets. Ensure that configuration updates only apply when the sender is authenticated or physically present on the expected link.
What to do and how to stay safe: AWS
- Upgrade FreeRTOS-Plus-TCP to version V4.4.2 to patch the source-verification flaws.
- Enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h to secure DNS resolution.
- Disable IPv6 Router Advertisement processing if immediate upgrades are not feasible.
- Restrict devices to trusted local resolvers to reduce exposure to DNS reply forgery.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of FreeRTOS-Plus-TCP are affected by these vulnerabilities?
Versions up to and including V4.4.1 are affected by both CVE-2026-102551 and CVE-2026-102552.
Is there a configuration-only workaround for the DNS resolver issue?
No, there is no configuration-only workaround on affected versions because responder source-IP validation did not exist prior to V4.4.2.
Does upgrading to V4.4.2 fix the DNS issue automatically?
No, upgrading alone does not remediate the DNS issue because the fix is an opt-in option disabled by default.
