Embedded Devices Face IPv6 and DNS Manipulation Risks Until AWS Patches FreeRTOS-Plus-TCP

Amazon Web Services published a security bulletin on October 16, 2026, detailing two vulnerabilities in FreeRTOS-Plus-TCP, an open-source TCP/IP stack for embedded devices. The issues affect versions up to V4.4.1 and allow remote third parties to potentially intercept or redirect network traffic. Organizations using these components must review their device configurations to ensure they are not exposed to traffic manipulation or data interception risks.

The risk

CVE-2026-102551 involves improper verification in the IPv6 Router Advertisement handler. The component fails to validate that advertisements come from on-link sources. According to AWS, a remote third-party might influence a device's IPv6 gateway and prefix configuration. This issue is reachable in the default library configuration where IPv6 and Router Advertisement processing are enabled, potentially enabling traffic interception.

CVE-2026-102552 affects the DNS resolver, which does not fully validate the source of DNS replies. A remote third-party might insert chosen addresses into the device's cache. This manipulation potentially redirects subsequent connections for affected names to attacker-controlled endpoints. AWS notes that responder source-IP validation is an opt-in feature that is disabled by default in the patched version, requiring manual configuration to remediate this specific flaw.

Who is exposed

The vulnerabilities impact any organization deploying embedded or IoT devices using FreeRTOS-Plus-TCP versions V4.4.1 or earlier. The risk is immediate for devices configured with default settings that enable IPv6 Router Advertisement processing. Organizations should check if their devices use the library's default configuration, where ipconfigUSE_IPv6 and ipconfigUSE_RA are both enabled, as this makes the IPv6 issue reachable.

Cost and compliance

The source material does not specify financial costs, regulatory fines, or specific compliance framework violations resulting from these vulnerabilities. AWS classifies the bulletin as important and requiring attention. No data is provided regarding the number of affected devices, specific industries targeted, or historical incidents involving these CVEs. Organizations should assess their own compliance requirements regarding secure network configuration and vulnerability management to determine internal reporting obligations.

What happens next

AWS has released version V4.4.2 to address these issues. For the DNS resolver vulnerability, upgrading alone is insufficient; administrators must enable the `ipconfigDNS_CHECK_REPLY_SOURCE_IP` setting in the configuration file. If immediate upgrades are impossible, AWS advises disabling IPv6 Router Advertisement processing for devices that do not require it. Organizations should verify that forked or derivative code incorporates these fixes.

Questions to ask your suppliers

Ask your hardware vendors whether their devices use FreeRTOS-Plus-TCP and if they have validated the network stack against the latest patches. Determine if the supplier provides a clear path for firmware updates and how long support is guaranteed for current models. Verify whether your contract includes security maintenance clauses that obligate the vendor to disclose and fix

Background: IoT device vulnerabilities

Internet of Things vulnerabilities stem from weak defaults, poor update mechanisms, and network isolation failures. You must segment these devices, change default settings immediately, and monitor traffic patterns. Ignoring these steps exposes your internal network to lateral movement by attackers who exploit the device’s limited security posture.

Read the full guide: IoT Device Vulnerabilities: Questions Answered for Secure Networks

What to do and how to stay safe

• Technical severity scores alone ignore whether a flaw is actually exploitable in your environment.
• External assets present a higher risk surface than internal systems due to easier attacker access.
• Business context determines the true cost of a breach, not just the technical impact of the code flaw.

Prioritize vulnerabilities by combining exploit probability with business context and exposure level. Start by mapping your external assets to your inventory and patching the most likely attack paths first.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.