{"id":"CVE-2026-120596","kind":"vulnerability","aliases":["CVE-2026-120596"],"related":[],"title":"Nut/OS TCP stack: one crafted packet freezes all TCP services","description":"A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.","summary":"A malformed TCP option with a zero length byte sends the Nut/Net TCP parser into an infinite loop in Nut/OS up to version 5.1. A single unauthenticated packet to any open TCP port stops all TCP services until the device is rebooted.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nut/OS","fixed":[],"affected":"<= 5.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["embedded","ethernut","infrastructure","nut-os","tcp-stack"],"not_affected_if":["not-on-network","nut-os-newer-than-5.1"],"how_to_check":"- Find the Nut/OS version your firmware was built with (the Nut/OS source tree or Configurator build); 5.1 and earlier are affected per NVD.\n- Check whether net/tcpsm.c NutTcpInputOptions rejects a TCP option whose length byte is 0; if it does not, the build is exposed.\n- Check whether the device is reachable on any open TCP port from untrusted networks. Also check any other product built on the Nut/Net stack.","fix":null,"status":"open","published_at":"2026-11-02T17:17:40+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","triaged_at":"2026-11-02T17:26:24+00:00","updated_at":"2026-11-02T17:27:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T17:26:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Nut/OS TCP stack: one crafted packet freezes all TCP services","impact":"medium","summary":"A malformed TCP option with a zero length byte sends the Nut/Net TCP parser into an infinite loop in Nut/OS up to version 5.1. A single unauthenticated packet to any open TCP port stops all TCP services until the device is rebooted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["nut-os","embedded","tcp-stack","ethernut"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"TCP services on the device stop responding until reboot","analyst_note":"Check the NVD entry and Ethernut/Egnite project pages for a fixed Nut/OS release and whether the flaw affects a specific product or only the general Nut/OS stack.","how_to_check":"- Check the Nut/OS version on the device or its firmware build; affected releases are up to `5.1`\n- Confirm whether the device runs Nut/OS with the Nut/Net TCP/IP stack exposed on the network\n- unknown for any other check, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["nut-os-newer-than-5.1","not-on-network"],"who_is_affected":"Only devices running Nut/OS up to version 5.1 with the Nut/Net TCP/IP stack are affected, and any open TCP port on them is a way in. Embedded boards and appliances built on Nut/OS are the systems to look at. The sources do not say whether a patch exists, so teams should treat exposed devices as at risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4238,"output_tokens":614,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the NVD entry and Ethernut/Egnite project pages for a fixed Nut/OS release and whether the flaw affects a specific product or only the general Nut/OS stack.","search":"'-120596':13A,16A '-2026':12A,15A '5.1':50B,99C 'affect':101C 'attack':104C 'base':155C 'block':145C 'byte':35B,119C 'contain':111C 'craft':5A 'cve':11A,14A 'denial':73C 'denial-of-servic':72C 'develop':91C 'devic':66B,130C,160C 'embed':18B 'ethernut':19B 'ethernut/egnite':93C 'exist':77C 'exploit':71C 'freez':7A 'function':142C 'includ':88C 'infinit':43B,138C 'infrastructur':20B 'length':34B,118C 'loop':44B,139C 'malform':28B,134C 'nut':22B 'nut-o':21B 'nut/net':38B,85C 'nut/os':1A,17A,46B,90C,94C 'nuttcpinputopt':143C 'one':4A 'open':57B,124C 'option':30B,81C,115C,135C 'os':23B 'packet':6A,54B 'parser':40B,82C 'perman':144C 'port':59B,126C 'process':132C,148C 'reboot':68B,162C 'releas':95C 'remot':70C 'render':151C 'segment':110C 'send':36B,106C 'servic':10A,63B,75C,156C 'singl':52B,108C 'stack':3A,26B,87C 'stop':60B 'tcp':2A,9A,25B,29B,39B,58B,62B,80C,109C,114C,125C,147C,154C 'tcp-base':153C 'tcp-stack':24B 'tcp/ip':86C 'thread':149C 'trigger':136C 'unauthent':53B,103C 'unknown':113C 'unrespons':157C 'version':49B,98C 'vulner':76C,129C 'zero':33B,121C","nicknames":[],"mitigations":[],"who_affected":"Devices running firmware built on Nut/OS (Ethernut/egnite) up to and including 5.1 with the Nut/Net TCP stack are affected; any open TCP port is enough, and no login is needed. Look at embedded boards and appliances built on Ethernut hardware or the Nut/OS RTOS. Devices not reachable over a network, or not using Nut/Net TCP, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["nutos"],"ptokens":["nut","os"],"labels":["embedded","ethernut","high","infrastructure","nutos","tcpstack"],"first_public_at":"2026-11-02T17:17:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120596","severity":null,"published_at":"2026-11-02T17:17:40+00:00","modified_at":"2026-11-02T17:17:40+00:00","first_seen_at":"2026-11-02T17:24:12+00:00","fetched_at":"2026-11-02T17:24:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120596:1405","url":null,"severity":null,"published_at":"2026-11-02T17:27:23+00:00","modified_at":"2026-11-02T17:27:23+00:00","first_seen_at":"2026-11-02T17:27:23+00:00","fetched_at":"2026-11-02T17:27:23+00:00","note":"NVD page returned no text; description taken from the signal. Ethernut download page lists stable 5.1 and beta 5.2.4; no vendor advisory or fixed release found, so the fix is unknown (settling it needs a diff of NutTcpInputOptions in 5.2.x or the SVN repository). Nothing verified. No PoC or exploitation found; no social search done (obscure product)."}],"documents":[{"id":53086,"url":"http://www.ethernut.de/en/download/","title":"Ethernut Download (stable 5.1, beta 5.2.4)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":53087,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120596","title":"NVD CVE-2026-120596","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}