CVE-2026-7422

Published: Apr 29, 2026 Last Modified: Mag 04, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,1
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Attack Vector: adjacent
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 6,5
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Attack Vector: adjacent_network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint.

To mitigate this issue, users should upgrade to the fixed version when available.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0003
Percentile
0,1th
Updated

EPSS Score Trend (Last 4 Days)

290

Authentication Bypass by Spoofing

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
View CWE Details
Application

Freertos-Plus-Tcp by Amazon

Product Information
Vendor Amazon
Product Freertos-Plus-Tcp
Version Range Affected
From 4.3.0 (inclusive)
To 4.4.1 (exclusive)
cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Freertos-Plus-Tcp by Amazon

Product Information
Vendor Amazon
Product Freertos-Plus-Tcp
Version Range Affected
From 4.0.0 (inclusive)
To 4.2.6 (exclusive)
cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://aws.amazon.com/security/security-bulletins/2026-021…
https://aws.amazon.com/security/security-bulletins/2026-021-aws/
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/…
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/…
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advi…
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-jpw4-6h5…