Loading story…
AWS published security bulletins for multiple vulnerabilities in FreeRTOS-Plus-TCP, including CVE-2026-7424, an integer underflow in the DHCPv6 sub-option parser. A separate advisory also disclosed a MAC address validation bypass and an integer underflow in ICMP Echo Reply processing, indicating that several network stack components can mishandle crafted traffic.
The issues affect packet parsing and validation logic in FreeRTOS-Plus-TCP, raising the risk that specially formed network input could bypass expected checks or trigger memory-handling errors in embedded and IoT deployments using the stack. The advisories identify the flaws as distinct but related weaknesses in low-level networking code, underscoring the need for organizations running FreeRTOS-based devices to review AWS guidance and apply available fixes or mitigations.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
AWS issued security bulletin AWS-2026-022 for CVE-2026-7424, describing an integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP.
AWS issued security bulletin AWS-2026-021 covering vulnerabilities in FreeRTOS-Plus-TCP involving a MAC address validation bypass and an integer underflow in ICMP Echo Reply handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
aws.amazon.com
Open sourceaws.amazon.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in the Linux kernel's netfilter `ip6t_eui64` component, tracked as **CVE-2026-31685**, allowed specially crafted IPv6 packets to trigger access to an invalid MAC header and potentially crash vulnerable systems. The bug was in `eui64_mt6()`, where the code could still call `eth_hdr(skb)` when the packet's MAC header was invalid if the fragment offset was zero, creating a remote denial-of-service condition during IPv6 packet processing. The issue affected code dating back to Linux kernel **2.6.12** and was fixed by rejecting invalid MAC headers for all packets before Ethernet header access. Upstream fixes were released across several stable kernel branches, including **6.12.83**, **6.18.24**, **6.19.14**, and **7.0**, while Red Hat shipped patches through security errata for multiple **RHEL 7, 8, 9, and 10** product variants. Red Hat rated the flaw **Moderate** with a **CVSS 7.1** for its products, although **cve.org** listed a **9.4** score, and both upstream and vendor guidance advised updating to the latest supported kernel packages.
Aug 25, 2026
Red Hat disclosed **CVE-2026-43037**, a critical Linux kernel flaw in the `ip6_tunnel` component that can be triggered by malicious ICMPv6 error messages against IPv4-over-IPv6 tunnel handling. The bug stems from reusing a cloned socket buffer control block with incompatible IPv6 and IPv4 metadata layouts, a form of **type confusion** tracked by MITRE as `CWE-843`. In the vulnerable path, `__ip_options_echo()` can interpret attacker-controlled packet data as IPv4 option data and copy an attacker-influenced length into a fixed 40-byte stack buffer, creating stack-based memory corruption that can cause denial of service and potentially arbitrary code execution with kernel privileges. Red Hat rated the issue **CVSS 8.8** and published fixes across multiple RHEL and related product streams, including **RHSA-2026:27719** for RHEL 6 Extended Lifecycle Support Extension. The upstream fix clears `skb2->cb[]` before calling `icmp_send()` and adds minimal IPv4 header validation requiring version 4 and an IHL of at least 5. Red Hat said updated kernel packages are available, including `kernel-2.6.32-754.61.1.el6` for affected RHEL 6 ELS architectures, advised customers to reboot after applying updates, and recommended preventing the `ip6_tunnel` module from loading as a temporary mitigation until patches are installed.
Aug 25, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026