CVE-2026-102552
Received Received - Intake

DNS Cache Poisoning in Amazon FreeRTOS-Plus-TCP

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: AMZN

Description
Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. To remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-102552
EUVD
EUVD-2026-103022

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRTOS FreeRTOS-Plus-TCP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-940 The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the DNS resolver in Amazon FreeRTOS-Plus-TCP failing to properly verify the source of DNS replies. A remote third-party can send a forged DNS response, which the device incorrectly accepts and caches. This allows the attacker to redirect the device to a malicious server by inserting a chosen address into its DNS cache.

Detection Guidance

This vulnerability cannot be directly detected through standard network commands as it involves improper DNS reply validation in FreeRTOS-Plus-TCP. Monitoring DNS traffic for unexpected replies or cache changes may indicate exploitation, but detection primarily relies on verifying the FreeRTOS-Plus-TCP version and configuration.

Impact Analysis

This vulnerability can lead to DNS cache poisoning, where an attacker redirects your device to a malicious server instead of the intended one. This could result in data being sent to the wrong destination, potential man-in-the-middle attacks, or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade FreeRTOS-Plus-TCP to version 4.4.2 or later. Enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in the configuration to validate DNS reply sources. Restrict devices to trusted local resolvers as an additional precaution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart