This vulnerability is an integer underflow in the DHCPv6 sub-option parser of FreeRTOS-Plus-TCP versions older than 4.4.1 and 4.2.6. A crafted DHCPv6 packet can cause the library to corrupt the device’s IPv6 address assignment, DNS configuration, and lease times, and can trigger a permanent freeze of the IP task that requires a hardware reset. The impact is thus a loss of network availability and a disruption of correct network configuration, but it does not directly expose sensitive data.

The affected product is AWS FreeRTOS-Plus-TCP. All builds before version 4.4.1 and 4.2.6 are vulnerable when DHCPv6 is enabled. Devices using these versions should be audited for DHCPv6 usage and the firmware version confirmed.

The CVSS score of 7.2 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a network-based attacker who can send a malicious DHCPv6 packet to the target device. Exploitation requires that the device has DHCPv6 enabled and is reachable on the local network.