FreeRTOS-Plus-TCP EUVD-2026-103022

Exploitation requires the device to be actively using the FreeRTOS-Plus-TCP DNS resolver and the attacker to inject a forged DNS reply that the resolver accepts before the genuine response. The key LIMITING factor is the source-verification check: version V4.4.2 adds and the remediation requires enabling ipconfigDNS_CHECK_REPLY_SOURCE_IP - devices are exposed while running pre-V4.4.2 firmware or with that source-IP check disabled. Additional limits: HIGH attack complexity (AC:H) means the attacker must defeat/guess DNS reply matching (source IP, port, transaction ID) and win a timing race, favoring on-path or local-network attackers over arbitrary internet senders. No authentication or user interaction is needed (PR:N/UI:N).

This is a genuine but conditional integrity risk rather than a drop-everything emergency. The input CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) and the vendor score of 8.2 agree with the description: an off-path, unauthenticated remote attacker can reach the DNS resolver over the network (AV:N, PR:N), but success hinges on forging a DNS reply that the device accepts, which is reflected in the HIGH attack complexity (AC:H) - the attacker must win a race and match query parameters (source port, transaction ID) before the legitimate reply arrives. Impact is scoped purely to integrity (VC:N/VI:H/VA:N): the attacker poisons the DNS cache with a chosen address, enabling downstream redirection/MITM, but gains no direct confidentiality or availability impact by itself. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - the 'Information Disclosure' tag also conflicts with the CVSS, which records zero confidentiality impact (VC:N) and full integrity impact (VI:H), so this should be treated as a spoofing/cache-poisoning (CWE-940) issue, not disclosure. Net assessment: prioritize patching for internet-exposed or untrusted-network embedded devices, but the AC:H race condition makes mass, reliable exploitation harder than the 8.2 headline suggests.

A remote off-path attacker on the network path (or able to spoof replies) floods the FreeRTOS device with forged DNS responses while it awaits a legitimate answer, racing to land a reply that matches the outstanding query. If accepted, the attacker's chosen IP is cached, so the device subsequently connects to an attacker-controlled host for the spoofed domain (e.g. a firmware/update or telemetry endpoint). No public exploit code was identified, and the CVSS HIGH attack complexity reflects the need to win this timing/ID-matching race.