The vulnerability resides in the DNS resolver logic of Amazon FreeRTOS‑Plus‑TCP. An attacker can send a forged DNS response that is accepted because the resolver does not verify the origin of the reply. The flaw allows the attacker to inject a chosen IP address into the device’s DNS cache, causing subsequent lookups of the same domain to resolve to the attacker supplied address. Because the vulnerability does not require authentication, any host on a network that can reach the device’s DNS interface can exploit it. The weakness is categorized as CWE‑940 and has the potential to disrupt confidentiality, integrity, and availability of network traffic.

All FreeRTOS‑Plus‑TCP builds before V4.4.2 are vulnerable. Versions V4.4.2 and later contain a configuration option ipconfigDNS_CHECK_REPLY_SOURCE_IP that validates the source of DNS replies. Devices deploying earlier releases must upgrade to V4.4.2 or newer to eliminate the flaw.

The CVSS score of 8.2 classifies the issue as high severity. The EPSS score is not available, but the lack of authentication and the ability to tamper with DNS cache make exploitation straightforward for a network attacker. The vulnerability is not included in the CISA KEV catalog. Attackers can likely exploit it by sending a forged DNS reply over the network interface that receives DNS traffic, bypassing the check and poisoning the cache.