Описание
Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option that is smaller than the expected structure size.
To mitigate this issue, users should upgrade to the fixed version when available.
Ссылки
- Vendor Advisory
- Release Notes
- Release Notes
- PatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 4.0.0 (включая) до 4.2.6 (исключая)Версия от 4.3.0 (включая) до 4.4.1 (исключая)
Одно из
cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*
cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*
EPSS
Процентиль: 14%
0.00233
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-125
EPSS
Процентиль: 14%
0.00233
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-125