216.73.217.22

CVE-2026-7422

· Published 29/04/2026 19:16 · Modified 29/04/2026 19:16

Labels: CVE-2026-7422 2026-04-29CVE-2026-7422CWE-290ff89ba41-3aa1-4d27-914a-91399e9639e5

Essential information

Published
29/04/2026 19:16
Modified
29/04/2026 19:16
Author
—
Creator
—
CVSS
7.1 HIGH (v3) 7.1 HIGH (v4.0)
CISA KEV
No
CWE
—
CVSS vector
—

CVSS metrics

Description

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
ff89ba41-3aa1-4d27-914a-91399e9639e5
NVD
View on NVD

Affected products (CPE)

ProductCPE
freertos / freertos plus tcp cpe:2.3:a:freertos:freertos_plus_tcp:<4.2.6:*:*:*:*:*:*:*
freertos / freertos plus tcp cpe:2.3:a:freertos:freertos_plus_tcp:4.4.1:*:*:*:*:*:*:*

References