CVE-2018-16598

MEDIUM 5.9CVE-2018-16598 · Published 06/12/2018 · updated 17/06/2026

In short

CVE-2018-16598 is a MEDIUM (CVSS 5.9) vulnerability affecting amazon web services freertos (amazon), freertos (amazon).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
amazon web services freertos amazon	`≤ 1.3.1`	No fix yet
freertos amazon	`≤ 10.0.1`	No fix yet

Description

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. In xProcessReceivedUDPPacket and prvParseDNSReply, any received DNS response is accepted, without confirming it matches a sent DNS request.

References

blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details · Patch
blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems · Third Party Advisory
aws/amazon-freertos · Release Notes

More vulnerabilities in amazon web services freertos

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

amazon web services freertos

amazon

≤ 1.3.1

No fix yet

freertos

amazon

≤ 10.0.1

No fix yet

Description

More vulnerabilities in amazon web services freertos

See all →