Dashboard / CVE-2026-7422

CVE-2026-7422

HIGH
MEDIUM Priority: 0.01 BB Relevance: 59/100
Published: 2026-04-29 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: None
S: X
AT: None
VC: None
VI: High
VA: None

Description

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
amazon freertos-plus-tcp 4.0.0 – 4.2.6
amazon freertos-plus-tcp 4.3.0 – 4.4.1

References & Advisories (4)

Bug Bounty Relevance

59 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.18%
Raw Score 0.001770
Percentile 7.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00177
2026-10-28
0.00177

Intelligence Sources

nvd ref →

External Links