CVE-2026-120596: Ethernut / egnite GmbH Nut/Net TCP/IP Stack, отказ на

Описание

Оригинално описание

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.

Засегнати продукти

• Ethernut / egnite GmbH Nut/Net TCP/IP Stack: Nut/OS 5.1

Вид слабост

• CWE-835 Loop with Unreachable Exit Condition

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-120596
• https://nvd.nist.gov/vuln/detail/CVE-2026-120596
• https://www.ethernut.de/en/download/index.html