CVE-2025-5688: LLMNR/mDNS Buffer Overflow Vulnerability

CVE-2025-5688 Overview

CVE-2025-5688 is an out-of-bounds write vulnerability in FreeRTOS-Plus-TCP affecting the processing of Link-Local Multicast Name Resolution (LLMNR) and Multicast DNS (mDNS) queries. The flaw triggers when the network stack processes DNS names of excessive length, leading to a buffer overflow on the stack. The vulnerability is classified under [CWE-787] (Out-of-bounds Write) and only impacts systems configured with Buffer Allocation Scheme 1 when LLMNR or mDNS is enabled. Successful exploitation can result in memory corruption, denial of service, or arbitrary code execution on affected embedded systems.

Critical Impact
An attacker on the local network can send crafted LLMNR or mDNS queries with malformed DNS names to corrupt memory on FreeRTOS-Plus-TCP devices, potentially achieving code execution on embedded targets.

Affected Products

FreeRTOS-Plus-TCP versions prior to V4.3.2
Systems using Buffer Allocation Scheme 1 with LLMNR enabled
Systems using Buffer Allocation Scheme 1 with mDNS enabled

Discovery Timeline

2025-06-04 - CVE-2025-5688 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5688

Vulnerability Analysis

The vulnerability resides in the DNS name parsing logic used by the LLMNR and mDNS responder components within FreeRTOS-Plus-TCP. When the stack receives a query containing a DNS name that exceeds expected boundaries, the code writes past the end of a fixed-size buffer. This out-of-bounds write corrupts adjacent stack memory.

The issue is scoped to deployments using Buffer Allocation Scheme 1, the zero-copy buffer model in FreeRTOS-Plus-TCP. Scheme 1 uses pre-allocated network buffers where buffer layout assumptions differ from Scheme 2. The DNS parsing routine fails to validate name length against the destination buffer size before copying bytes from the incoming packet.

Root Cause

The root cause is missing length validation in the LLMNR and mDNS query handler when processing the labeled DNS name format. DNS names are encoded as a series of length-prefixed labels terminated by a zero byte. The handler trusts the cumulative label length without enforcing the maximum DNS name size of 255 bytes against the local buffer. A crafted query with oversized labels causes the parser to write beyond buffer boundaries.

Attack Vector

An attacker must be positioned on the same local network segment as the target device, since LLMNR (UDP port 5355) and mDNS (UDP port 5353) are link-local protocols. The attacker sends a multicast or unicast query containing a maliciously crafted DNS name. No authentication or user interaction is required. The CVSS vector indicates local network adjacency with attack requirements present, reflecting the need for LLMNR or mDNS to be enabled and Buffer Allocation Scheme 1 to be in use.

No verified public proof-of-concept code is available. Technical details are described in the GitHub Security Advisory GHSA-5x4f-fvv8-wr65 and the AWS Security Bulletin AWS-2025-012.

Detection Methods for CVE-2025-5688

Indicators of Compromise

Unexpected device resets, watchdog triggers, or crashes on FreeRTOS-based embedded systems following LLMNR or mDNS traffic
Malformed LLMNR (UDP 5355) or mDNS (UDP 5353) packets containing DNS names approaching or exceeding 255 bytes
Repeated multicast DNS queries from a single source on the local network segment

Detection Strategies

Inspect link-local multicast traffic on UDP ports 5353 and 5355 for DNS queries with abnormally long label sequences
Deploy network intrusion detection rules that flag LLMNR or mDNS packets with non-compliant label length fields
Correlate device crash telemetry with concurrent multicast DNS query activity on the same VLAN

Monitoring Recommendations

Enable logging on network segments hosting FreeRTOS-Plus-TCP devices to capture LLMNR and mDNS packet metadata
Monitor embedded device uptime and reboot counters for anomalous reset patterns
Audit network captures from IoT and OT segments for DNS queries with label lengths exceeding RFC 1035 limits

How to Mitigate CVE-2025-5688

Immediate Actions Required

Upgrade FreeRTOS-Plus-TCP to version V4.3.2 or later, available at the FreeRTOS-Plus-TCP V4.3.2 release page
Identify and patch any forked or derivative codebases that incorporate vulnerable FreeRTOS-Plus-TCP source
Inventory embedded devices using Buffer Allocation Scheme 1 with LLMNR or mDNS enabled

Patch Information

The FreeRTOS project released version V4.3.2 containing the fix for CVE-2025-5688. Refer to the GitHub Security Advisory GHSA-5x4f-fvv8-wr65 for advisory details and the AWS Security Bulletin AWS-2025-012 for AWS-specific guidance on affected services and customer responsibilities.

Workarounds

Disable LLMNR by setting ipconfigUSE_LLMNR to 0 in FreeRTOSIPConfig.h if name resolution is not required
Disable mDNS by setting ipconfigUSE_MDNS to 0 in FreeRTOSIPConfig.h where service discovery is unnecessary
Switch to Buffer Allocation Scheme 2 if application requirements permit, as the vulnerability is scoped to Scheme 1
Segment affected devices onto isolated network zones where untrusted hosts cannot reach UDP ports 5353 and 5355

bash

# Configuration example: disable LLMNR and mDNS in FreeRTOSIPConfig.h
#define ipconfigUSE_LLMNR    0
#define ipconfigUSE_MDNS     0