PT-2025-41584 · Unknown · Freertos-Plus-Tcp

Ivan Gotovchits · Published 2025-10-10 · Updated 2025-10-11 · CVE-2025-11618

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions FreeRTOS-Plus-TCP (affected versions not specified)

Description A missing validation check in the UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header. This issue only affects applications using IPv6.

Recommendations Upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-13129

CVE-2025-11618

GHSA-6FH9-MQXJ-HMWJ

Affected Products

Freertos-Plus-Tcp

References · 10

• https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-6fh9-mqxj-hmwj · Vendor Advisory
• https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.4 · Patch
• https://bdu.fstec.ru/vul/2025-13129 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11618 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11618 · Vendor Advisory
• https://aws.amazon.com/security/security-bulletins/AWS-2025-023 · Vendor Advisory
• https://aws.amazon.com/ru/security/security-bulletins/AWS-2025-023 · Note
• https://twitter.com/VulmonFeeds/status/1976827384683786474 · Twitter Post
• https://twitter.com/CVEnew/status/1976702116044718186 · Twitter Post
• https://t.me/CVEtracker/34608 · Telegram Post