CVE-2026-120596 in Nut
Summary
by MITRE • 11/02/2026
A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified involves a critical flaw within the Transmission Control Protocol options parser of the Nut/Net TCP/IP stack, which is integrated into the Nut/OS embedded operating system developed by Ethernut/Egnite. This specific weakness affects versions up to 5.1 and represents a significant risk for devices relying on this network stack for connectivity. The core issue stems from insufficient validation logic when processing incoming TCP segments that contain option fields with anomalous length values. Specifically, the parser fails to correctly handle scenarios where an unknown TCP option is presented with a length byte set to zero. In standard networking protocols, such malformed packets should be discarded or handled gracefully without disrupting the host system's network stack operations. However, in this implementation, the lack of proper boundary checks and error handling allows the flawed input to trigger unintended control flow within the parsing routine.
From a technical perspective, the defect resides in the NutTcpInputOptions function, which is responsible for iterating through and interpreting TCP options included in incoming segments. When an attacker sends a single TCP segment containing this specific malformed option, the parser enters an infinite loop rather than terminating or returning an error code. This behavior effectively hangs the thread dedicated to processing TCP input operations. Since embedded systems often rely on lightweight threading models where network processing is handled by a dedicated background task, freezing this thread has immediate and severe consequences for system availability. The operating system does not automatically recover from this state without external intervention, meaning the device becomes unresponsive to any further TCP-based communications until it is manually rebooted or reset.
The operational impact of this vulnerability is a complete denial-of-service condition for all network services that depend on TCP transport layer protocols. Because the infinite loop blocks the primary TCP processing thread, no new connections can be established, and existing sessions are effectively frozen. This renders critical remote management interfaces, data collection endpoints, or service applications inaccessible to legitimate users. The vulnerability is particularly dangerous because it requires only a single packet from an unauthenticated attacker over the network. There is no need for prior authentication or complex exploitation steps, making this attack vector highly accessible and easy to execute against any device running the affected Nut/OS version with open TCP ports exposed on the network.
This flaw aligns with CWE-835, which describes a loop involving an infinite wait condition that can lead to resource exhaustion or denial of service. Additionally, from a threat modeling perspective consistent with the MITRE ATT&CK framework, this vulnerability facilitates remote service disruption and could be categorized under techniques related to network service exploitation where availability is targeted rather than confidentiality or integrity. The simplicity of the attack vector underscores the importance of robust input validation in embedded networking stacks, which are often deployed in environments where physical access for recovery may be difficult or costly.
To mitigate this risk, organizations must prioritize patching affected systems by upgrading Nut/OS to a version later than 5.1, where the TCP options parser has been corrected to properly validate option lengths and handle malformed packets without entering infinite loops. For devices that cannot immediately undergo an upgrade due to legacy constraints or certification requirements, network-level mitigations should be implemented. Deploying intrusion prevention systems or firewall rules capable of detecting and dropping TCP segments with suspiciously short or zero-length options can provide a layer of defense against this specific attack vector. Furthermore, implementing watchdog timers on the embedded devices may help detect when the TCP processing thread has become unresponsive and trigger an automatic system reset to restore service availability until permanent patches are applied.