Is CVE-2026-102551 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102551 being exploited in the wild.

How severe is CVE-2026-102551?

High severity, with a CVSS score of 7.7, published 16 October 2026.

Which products and versions are affected?

Amazon Freertos-Plus-Tcp through 4.4.1.

Is there a fix for CVE-2026-102551?

Yes: fixed in FreeRTOS-Plus-TCP 4.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102551 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102551?

Check whether you run Amazon AWS or Amazon Freertos-Plus-Tcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102551: FreeRTOS-Plus-TCP improper source verification in IPv6 Router Advertisement and DNS resolver

CVE-2026-102551 · Severity: high · CVSS 7.7 · Published 2026-10-16

FreeRTOS-Plus-TCP is a networking library used in embedded and IoT devices to handle TCP/IP communications. Two validation flaws allow remote attackers to intercept IPv6 traffic or redirect DNS lookups by spoofing network replies, potentially hijacking device connections without authentication.

Technologies: Amazon AWS, Amazon Freertos-Plus-Tcp. Vendors: Amazon.

Quick answers

Is CVE-2026-102551 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102551 being exploited in the wild.
How severe is CVE-2026-102551?: High severity, with a CVSS score of 7.7, published 16 October 2026.
Which products and versions are affected?: Amazon Freertos-Plus-Tcp through 4.4.1.
Is there a fix for CVE-2026-102551?: Yes: fixed in FreeRTOS-Plus-TCP 4.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102551 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102551?: Check whether you run Amazon AWS or Amazon Freertos-Plus-Tcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FreeRTOS-Plus-TCP 4.4.2 or later

Technical details

CVE-2026-102551 is an improper source verification flaw in the IPv6 Router Advertisement handler that fails to validate on-link origin before accepting router configuration, allowing an attacker to influence gateway, prefix, and address settings. CVE-2026-102552 is a similar flaw in the DNS resolver that fails to validate reply origin, allowing DNS cache poisoning. Both are reachable over the network in default configurations.

Affected products

Amazon FreeRTOS-Plus-TCP through 4.4.1

Identifiers

CVE-2026-102551
CVE-2026-102552

Timeline

2026-10-16: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.