Which versions of FreeRTOS-Plus-TCP are affected by EUVD-2026-26275?

Amazon FreeRTOS-Plus-TCP versions 4.0.0-4.4.0 contain a MAC-spoofing validation bypass (CVE-2026-7422) that allows adjacent-network packet injection, compromising data integrity on connected IoT and…. A patch is available.

How to fix or mitigate EUVD-2026-26275?

Within 24 hours: Identify and inventory systems running affected FreeRTOS-Plus-TCP versions 4.0.0-4.2.5 or 4.3.0-4.4.0. Within 7 days: Deploy available vendor patches from Amazon to all vulnerable devices, prioritizing production systems and those with external network exposure. Within 30 days: Complete patch deployment across all inventory and implement network segmentation to isolate FreeRTOS-based systems from untrusted adjacent networks.

FreeRTOS-Plus-TCP EUVD-2026-26275

Q: What is the CVSS score of EUVD-2026-26275?

EUVD-2026-26275 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7422 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-04-29 AMZN

Authentication Bypass AWS Freertos Plus Tcp

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Adjacent L2 access with trivial MAC spoofing gives AV:A/AC:L/PR:N/UI:N; impact is integrity-only (I:H) via validation bypass, with no disclosure or DoS.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 01:32 vuln.today

Analysis Generated

Jul 24, 2026 - 01:32 vuln.today

Severity Changed

Apr 29, 2026 - 19:22 NVD

MEDIUM HIGH

CVSS changed

Apr 29, 2026 - 19:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

EUVD ID Assigned

Apr 29, 2026 - 19:00 euvd

EUVD-2026-26275

Patch released

Apr 29, 2026 - 19:00 nvd

Patch available

CVE Published

Apr 29, 2026 - 18:35 nvd

HIGH 7.1

DescriptionCVE.org

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint.

To mitigate this issue, users should upgrade to the fixed version when available.

AnalysisAI

Checksum and size-validation bypass in Amazon's FreeRTOS-Plus-TCP stack (versions 4.0.0 through 4.2.5 and 4.3.0 through 4.4.0) lets an adjacent-network attacker inject malformed packets by spoofing the Ethernet source MAC to match one of the device's own registered endpoint MACs, causing the loopback-detection path to skip all input validation. This is a CWE-290 spoofing/authentication-bypass flaw carrying a CVSS 4.0 base of 7.1 with integrity-only impact and no confidentiality or availability loss. No public exploit identified at time of analysis, EPSS is 0.02% (4th percentile), and CISA SSVC rates exploitation as none and automatable as no, so real-world urgency is modest despite the medium-high score.

Technical ContextAI

FreeRTOS-Plus-TCP is the lightweight TCP/IP stack bundled with the FreeRTOS real-time operating system, widely used on resource-constrained embedded and IoT microcontrollers (CPE cpe:2.3:a:aws:freertos-plus-tcp). The defect lives in the stack's loopback-detection logic: to short-circuit processing of packets the device sent to itself, the code compares an incoming Ethernet frame's source MAC against the MACs of its own registered endpoints and, on a match, treats the frame as trusted loopback traffic and skips checksum verification and minimum-size validation. Because MAC source addresses are trivially forgeable on a shared L2 segment, an attacker can assert a device's own endpoint MAC to reach this trusted path. The root cause is CWE-290 (Authentication Bypass by Spoofing) - using an easily spoofed identity attribute (source MAC) as an implicit trust signal.

RemediationAI

Vendor-released patch: upgrade FreeRTOS-Plus-TCP to V4.2.6 (for the 4.0.0-4.2.x branch) or V4.4.1 (for the 4.3.0-4.4.x branch); release tags are at https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6 and https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1, with vendor guidance in AWS bulletin 2026-021 (https://aws.amazon.com/security/security-bulletins/2026-021-aws/). For embedded fleets this means rebuilding firmware against the patched library and pushing an OTA/field update. Where immediate patching is not feasible, compensating controls target the adjacent-network prerequisite: isolate affected devices onto a dedicated VLAN or segment with no untrusted hosts, enforce switch-level port security, dynamic ARP inspection, or MAC filtering to make source-MAC spoofing harder, and restrict the stack's loopback handling if the application does not require self-addressed traffic. Trade-offs: strict MAC/port security can break legitimate topology changes and roaming, and VLAN isolation may complicate device-to-device communication that some applications rely on.