CVE-2026-7423 — Denial of Service

title: FreeRTOS-Plus-TCP ICMP/ICMPv6 Integer Underflow DoS — CVE-2026-7423
id: scw-2026-04-29-ai-1
status: experimental
level: high
description: |
  This rule detects potential exploitation of CVE-2026-7423, an integer underflow vulnerability in FreeRTOS-Plus-TCP's ICMP and ICMPv6 echo reply handlers. The vulnerability allows an adjacent network user to cause a denial of service (device crash) by sending crafted ICMP/ICMPv6 echo requests that trigger an out-of-bounds read. This rule specifically looks for network traffic that could be indicative of such an attack, focusing on the source and destination IP addresses and ports involved in network communication, assuming a firewall log source that captures such events. The 'allow' action is a placeholder, as the specific log source might vary, but the presence of network traffic between adjacent IPs and ports is the key indicator for this vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-04-29
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7423/
tags:
  - attack.impact
  - attack.t1499
logsource:
    category: firewall
detection:
  selection:
      src_ip|exists: true
      dst_ip|exists: true
      dst_port|exists: true
      action|contains:
          - 'allow'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse