What is CVE-2026-120596 in Nut/OS?

CVE-2026-120596 is a critical denial-of-service vulnerability affecting the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. The flaw carries a CVSS base score of 7.5, indicating a high severity risk for connected network devices.

To contextualize this risk in embedded systems, similar networking stack flaws require strict updates, akin to how developers manage dependencies in Rust zip library vulnerabilities or broader privilege concerns like ActivityClientController local escalation.

The root cause stems from CWE-835, where the parser fails to properly handle length constraints on incoming option fields.

Who is affected by this TCP parser flaw?

All deployments utilizing Nut/OS releases up to version 5.1 are susceptible to this flaw. Embedded systems running network services exposed directly to untrusted networks face the highest operational risk.

Since other components in enterprise software occasionally face permission bypasses similar to ActivityStarter escalation flaws, isolating critical IoT hardware remains a paramount task for system administrators.

How does the denial-of-service attack work?

An unauthenticated remote attacker can trigger the vulnerability by sending a single TCP segment containing an unknown TCP option with a length byte of zero to any open port. This malformed input forces the NutTcpInputOptions function into an infinite loop, permanently blocking the thread and rendering all TCP services completely unresponsive until a physical reboot occurs.

As administrative oversight grows more complex across connected endpoints, maintaining awareness of advisory feeds like reference details on ethernut.de is critical to maintaining uptime.

How do I protect my systems?

System administrators should secure their embedded devices by applying official software patches as soon as they are released by the maintainers.

You can check for updates and review official mitigation guidance directly on ethernut.de download page.

  1. Monitor official channels at ethernut.de for updated firmware releases beyond version 5.1.
  2. Restrict network access to exposed TCP ports using firewalls or perimeter security controls.
  3. Implement network monitoring to detect abnormal TCP option structures containing zero-length fields.
  4. Prepare automated device watchdog mechanisms to safely reboot hardware in the event of an unresponsive thread.