Nut/OS CVE-2026-120596

The only prerequisites are network reachability to the device and at least one open/listening TCP port; the attacker then sends one TCP segment containing an unknown TCP option with a length byte of zero, which is parsed by NutTcpInputOptions. No authentication, user interaction, or non-default configuration is required (PR:N/UI:N), and it works against standard Nut/OS builds running the Nut/Net stack at version 5.1 or earlier. Limiting factors that bound realistic risk: the device must expose a reachable TCP service to the attacker's network position; the impact is confined to availability (TCP services hang until a manual reboot) with no confidentiality or integrity effect and no code execution; and recovery requires a device reboot rather than leaving a persistent compromise.

Signals are internally consistent and point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact - purely a denial-of-service, matching CWE-835 (infinite loop) and the description of a single malformed TCP option hanging the TCP thread. The SSVC framework reinforces this: Exploitation 'none' (no observed or public exploitation), Automatable 'yes' (a single crafted segment to any open port requires no target-specific setup), and Technical Impact 'partial' (availability loss of TCP services, not full device compromise). The vuln.today decision label is 'this_week', i.e. prompt but not emergency action. No EPSS score was supplied, the CVE is not on CISA KEV, and no PoC or exploit reference is present - so there is no public exploit identified at time of analysis. The practical ceiling on risk is that the outcome is a reboot-recoverable DoS against embedded devices, not code execution or data theft; the practical floor-raiser is that the trigger is trivial and automatable against any listening TCP port. This is a real 'fix this week' availability issue for operators of affected Nut/OS devices rather than a high-CVSS-but-illusory finding, but it is not a drop-everything emergency: there is no evidence of active exploitation and impact is confined to availability.

An unauthenticated attacker with network reachability to an affected Nut/OS device sends a single TCP segment to any open TCP port, embedding an unknown TCP option whose length byte is set to zero. When NutTcpInputOptions processes it, the parser enters an infinite loop that permanently blocks the TCP processing thread, leaving all TCP-based services unresponsive until the device is manually rebooted. No public exploit identified at time of analysis, but the low-complexity, single-packet nature makes it straightforward to reproduce.