CVE-2026-120596: High severity vulnerability
A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.
Event History
Frequently Asked Questions
Which devices are exposed to this denial of service?
Devices running Nut/OS up to version 5.1 are exposed if they have any open TCP port reachable by an attacker. The affected TCP/IP stack is Nut/Net, developed by Ethernut/Egnite.
What must an attacker do to trigger the issue?
No authentication or user interaction is required. An attacker only needs to send one TCP segment to an open TCP port containing an unknown TCP option whose length byte is zero.
Does the attack require an established TCP connection?
The provided information states that the malformed segment can be sent to any open TCP port. It does not identify an established connection as a prerequisite.
What is the operational impact after exploitation?
Processing the malformed option causes an infinite loop in NutTcpInputOptions, permanently blocking the TCP processing thread. All TCP-based services become unresponsive until the device is rebooted.