FreeRTOS DNS Fix Requires a Configuration Change After the Upgrade

An AWS advisory makes firmware settings part of the remediation: installing the fixed network library alone does not close the DNS issue.

The patch has a second step

AWS disclosed two FreeRTOS-Plus-TCP vulnerabilities on October 16, including a DNS issue whose remedy requires more than replacing the library. Both affect versions through V4.4.1. Version V4.4.2 provides fixes, but AWS says DNS reply source-IP checking is optional and disabled by default. Users addressing CVE-2026-102552 must also enable ipconfigDNS_CHECK_REPLY_SOURCE_IP in FreeRTOSIPConfig.h. The distinction matters for embedded-device owners who receive firmware from a supplier rather than compile it themselves.

Two different paths to redirected traffic

According to AWS, the DNS resolver can accept a reply without sufficiently validating that it came from the queried server, potentially redirecting later connections. The other flaw, CVE-2026-102551, concerns IPv6 Router Advertisements and can affect network configuration. AWS describes conditional exposure, not a confirmed campaign against customers. Its advisory also calls for fixes to reach forked and derivative code. That makes a product-specific supplier response more useful than a general statement that an upstream release exists.

Ask for evidence tied to the device

Our analysis is that a manufacturing operator should ask its device supplier which shipped firmware includes the repaired library and the required DNS setting. A response naming only the upstream version leaves an important question unresolved. The answer should identify the device model, firmware build and affected configuration, with a supported installation procedure. A plant should coordinate any update with operational personnel and test the relevant device functions before a wider rollout.

Close the gap between release notes and deployment

A telecommunications team reviewing embedded equipment faces the same ownership problem across appliance suppliers and maintenance contractors. A useful remediation record connects a vendor response to an asset inventory and a completed maintenance ticket. Where an update cannot be deployed immediately, document the reason, the vendor-supported mitigation and the date for review. Network restrictions should not be recorded as an equivalent permanent fix without evidence. For MSPs, the practical service is to obtain and reconcile these answers, then report which devices are fixed, awaiting a supplier response or outside the assessed scope. Counting firmware packages downloaded will not establish that the protected configuration reached the equipment.