FreeRTOS-Plus-TCP EUVD-2026-103021

Exploitation requires the target to run FreeRTOS-Plus-TCP before V4.4.2 with IPv6 enabled and IPv6 Router Advertisement/autoconfiguration processing active. The attacker must be positioned on the same local link as the victim, because IPv6 Router Advertisements are link-local ICMPv6 multicast messages (enforced hop limit 255) that cannot be routed across networks - this is the limiting factor captured by AT:P and is the practical bound on the otherwise 'remote' AV:N rating. No authentication (PR:N) and no user interaction (UI:N) are required. The core enabling condition is the handler's failure to verify the source of the advertisement (CWE-940), allowing a crafted RA to override the endpoint's default gateway, on-link prefix, and address configuration.

This is a high-priority issue for affected embedded deployments, though its real-world risk is constrained by network positioning. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L) yields a 9.2 (Critical) and confirms unauthenticated exploitation (PR:N) with no user interaction (UI:N). Critically, AT:P (Attack Requirements: Present) signals that exploitation depends on conditions outside the attacker's control - consistent with IPv6 Router Advertisements being link-local, non-routable multicast traffic (hop limit 255), so the attacker must be positioned on the same local link rather than truly arbitrary-remote. No EPSS score was provided, and there is NO CISA KEV listing and NO public POC referenced, so there is no evidence of active exploitation - the 9.2 reflects potential impact (MITM/traffic redirection via spoofed gateway and prefix) rather than demonstrated in-the-wild use. CONFLICT TO NOTE: the vendor labels the impact 'Information Disclosure' and rates confidentiality/integrity High, but influencing the default gateway and on-link prefix is primarily a traffic-redirection / man-in-the-middle primitive - information disclosure is a downstream consequence, not the core flaw (CWE-940, improper source verification). Net: treat as a Critical fix-now item for IPv6-enabled FreeRTOS-Plus-TCP devices on untrusted networks, but recognize the adjacency requirement sharply limits mass remote exploitation.

An attacker on the same local network segment as a FreeRTOS-Plus-TCP endpoint (before V4.4.2) with IPv6 enabled crafts a malicious ICMPv6 Router Advertisement. Because the handler does not properly verify the source of the advertisement, the attacker sets a rogue default gateway and on-link prefix, redirecting the device's IPv6 traffic through attacker-controlled infrastructure for interception or manipulation. No public exploit is identified at time of analysis, but RA-spoofing tooling for IPv6 is well established generally.