CVE-2026-102551

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.

A remote attacker can redirect a victim's network traffic or disrupt communication, leading to data interception or denial of service. This poses a serious threat to the network security of embedded devices.

Upgrade Amazon FreeRTOS-Plus-TCP to version V4.4.2 or later. Until patched, consider filtering or disabling unauthenticated Router Advertisements on the network.