Nut/Net TCP/IP stack infinite loop in TCP option parsing stalls services
Embedded devices can have their network service frozen by remote attackers.
Summary
A flaw in the TCP options parser of the Nut/Net TCP/IP stack in Nut/OS lets an unauthenticated remote attacker make all TCP services unresponsive. Nut/OS releases up to version 5.1 are affected.
Affected when
- Nut/OS 5.1 or earlier
- Device with open TCP ports
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen