{"cve":"CVE-2026-7422","nvd":{"published":"2026-04-29T19:16:26.487","modified":"2026-10-26T20:10:00.160","status":"Analyzed","description":"Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint.\n\n\n\nTo mitigate this issue, users should upgrade to the fixed version when available.","cvss_v4":{"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":6.5},"cwes":["CWE-290"],"references":["https://aws.amazon.com/security/security-bulletins/2026-021-aws/","https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6","https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1","https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-jpw4-6h59-62w9"],"products":["amazon:freertos-plus-tcp"],"source":"nvd","synced_at":"2026-10-26T20:34:58.897451322+00:00"},"epss":{"cve":"CVE-2026-7422","score":0.00177,"percentile":0.07228,"date":"2026-10-26"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}