What is CVE-2026-102552?

CVE-2026-102552 is a medium-severity vulnerability in Freertos Freertos-Plus-Tcp, classified under Improper Verification of Source of a Communication Channel. CVSS score: 5.9/10. Published 2026-10-16.

How severe is CVE-2026-102552?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Freertos Freertos-Plus-Tcp

CVE-2026-102552

Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.

Published 2026-10-16 · last modified 2026-10-16.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Freertos Freertos-Plus-Tcp

Weakness classification (CWE)

CWE-940 — Improper Verification of Source of a Communication Channel

References

ff89ba41-3aa1-4d27-914a-91399e9639e5 (release-notes, patch)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (third-party-advisory)

Frequently asked questions

What is CVE-2026-102552?: CVE-2026-102552 is a medium-severity vulnerability in Freertos Freertos-Plus-Tcp, classified under Improper Verification of Source of a Communication Channel. CVSS score: 5.9/10. Published 2026-10-16.
How severe is CVE-2026-102552?: Medium severity. CVSS v3 base score is 5.9 out of 10.