Descripción
Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device-s own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.
CVSS 6.5EPSS 0.17700000000000002%Riesgo 0.66
Ver fuente- Publicación
- 2026-04-29 19:16:26
- Versiones afectadas
- <4.2.6,<4.4.1
- Tipo
- Firmware
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N