Vulnerability in Amazon Freertos-Plus-Tcp
CVE-2026-7422
Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (18.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 18.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Amazon Freertos-Plus-Tcp
- AWS Freertos-Plus-Tcp — versions 4.0.0, 4.3.0, 4.2.6
Weakness classification (CWE)
References
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory, Vendor Advisory)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (patch, Release Notes)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (patch, Release Notes)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (Patch, third-party-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-7422?
- CVE-2026-7422 is a medium-severity vulnerability in Amazon Freertos-Plus-Tcp, classified under Authentication Bypass by Spoofing. CVSS score: 6.5/10. Published 2026-04-29.
- How severe is CVE-2026-7422?
- Medium severity. CVSS v3 base score is 6.5 out of 10.