CVE-2026-102552: Amazon FreeRTOS-Plus-TCP SSRF Vulnerability

CVE-2026-102552 Overview

CVE-2026-102552 is a DNS cache poisoning vulnerability in the DNS resolver of Amazon FreeRTOS-Plus-TCP before version V4.4.2. The resolver fails to properly verify the source of incoming DNS replies, allowing a remote third-party to insert an attacker-chosen address into the device's DNS cache via a forged DNS response. The flaw is categorized as [CWE-940] Improper Verification of Source of a Communication Channel. FreeRTOS-Plus-TCP is widely deployed in embedded and Internet of Things (IoT) devices, which expands the exposure surface across constrained edge environments.

Critical Impact
An unauthenticated remote attacker can poison the DNS cache of affected devices and redirect subsequent connections to attacker-controlled hosts, enabling traffic interception and integrity attacks.

Affected Products

Amazon FreeRTOS-Plus-TCP versions prior to V4.4.2
Embedded and IoT devices integrating the vulnerable FreeRTOS-Plus-TCP DNS resolver
Firmware builds that leave ipconfigDNS_CHECK_REPLY_SOURCE_IP disabled

Discovery Timeline

2026-10-16 - CVE-2026-102552 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-102552

Vulnerability Analysis

The DNS resolver in FreeRTOS-Plus-TCP accepts DNS replies without strictly validating that the response originates from the queried DNS server. An attacker able to send UDP packets to the device, or positioned to race the legitimate server, can craft a forged DNS reply that the resolver accepts as valid. The resolver then stores the attacker-supplied record in the DNS cache, where it is reused for subsequent name lookups.

Successful poisoning allows the attacker to control the address returned for a given hostname. The device will then connect to an attacker-chosen endpoint for firmware updates, telemetry, cloud services, or any other hostname-based communication. The integrity impact is high even though confidentiality and availability of the resolver itself are not directly compromised.

Root Cause

The root cause is the absence of enforced source-address verification on inbound DNS responses. The configuration option ipconfigDNS_CHECK_REPLY_SOURCE_IP, which binds reply validation to the queried server's IP address, was not enabled or enforced by default. Without that check, the resolver relies on transaction identifiers and ports alone, which an attacker can brute force or predict in constrained embedded stacks.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker sends spoofed UDP DNS replies to the target while a legitimate query is outstanding, or opportunistically floods the device to pre-seed the cache. The attack complexity is elevated because the attacker must win the race against the legitimate resolver and match transaction state. Technical details are described in the GitHub Security Advisory GHSA-h4fw-pv82-p7h5 and the AWS Security Bulletin 2026-139.

Detection Methods for CVE-2026-102552

Indicators of Compromise

Unexpected DNS responses arriving from source addresses that do not match the configured upstream DNS server.
Devices resolving known hostnames (update servers, MQTT brokers, cloud endpoints) to unexpected IP addresses.
Outbound connections from embedded devices to IPs outside the vendor's published infrastructure ranges.

Detection Strategies

Inspect UDP/53 traffic at network boundaries for DNS replies whose source IP differs from the queried resolver.
Correlate device DNS query logs with returned answers to identify answer sections that do not match the authoritative response.
Baseline hostname-to-IP mappings for FreeRTOS fleets and alert on deviations.

Monitoring Recommendations

Enable DNS traffic capture on network segments hosting FreeRTOS-based devices and retain for forensic review.
Monitor firmware update and telemetry endpoints for connections originating from unexpected destinations.
Alert on sudden changes in cached DNS entries reported by device telemetry where available.

How to Mitigate CVE-2026-102552

Immediate Actions Required

Upgrade FreeRTOS-Plus-TCP to version V4.4.2 or later across all affected firmware images.
Enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h and rebuild firmware.
Restrict DNS traffic from embedded devices to known, trusted resolvers using network ACLs.

Patch Information

Amazon addressed the issue in FreeRTOS-Plus-TCP Release V4.4.2. The fix requires both upgrading to V4.4.2 and setting ipconfigDNS_CHECK_REPLY_SOURCE_IP to enforce source-address validation on DNS replies. Refer to the AWS Security Bulletin 2026-139 for vendor guidance.

Workarounds

Place affected devices behind a trusted recursive resolver that validates DNS responses on their behalf.
Block inbound UDP/53 traffic to devices from all sources except the designated DNS resolver.
Pin critical destination addresses in device configuration where DNS resolution is not strictly required.

bash

# Configuration example - FreeRTOSIPConfig.h
#define ipconfigUSE_DNS                     1
#define ipconfigDNS_CHECK_REPLY_SOURCE_IP   1