CVE-2018-16603

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. Out of bounds access to TCP source and destination port fields in xProcessReceivedTCPPacket can leak data back to an attacker.

• CWE-200

• https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/Exploit, Third Party Advisory
• https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/Third Party Advisory
• https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/Exploit, Third Party Advisory
• https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/Third Party Advisory
• https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.mdRelease Notes, Third Party Advisory

Published

Dec 6, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16598An issue was discovered in Amazon Web Services (AWS) FreeRTO…
• CVE-2018-16599An issue was discovered in Amazon Web Services (AWS) FreeRTO…
• CVE-2018-1660IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to…5.4
• CVE-2018-16600An issue was discovered in Amazon Web Services (AWS) FreeRTO…
• CVE-2018-16601An issue was discovered in Amazon Web Services (AWS) FreeRTO…
• CVE-2018-16602An issue was discovered in Amazon Web Services (AWS) FreeRTO…
• CVE-2018-16604An issue was discovered in Nibbleblog v4.0.5. With an admin'…
• CVE-2018-16605D-Link DIR-600M devices allow XSS via the Hostname and Usern…5.4
• CVE-2018-16606In ProConf before 6.1, an Insecure Direct Object Reference (…
• CVE-2018-16607Cross-site scripting (XSS) vulnerability in the Orgs Page in…
• CVE-2018-16608In Monstra CMS 3.0.4, an attacker with 'Editor' privileges c…
• CVE-2018-1661IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnera…6.5