Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5964 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Malformed TCP Options, IP Fragments and IPv6/ICMPv6 Headers Reaching Embedded TCP/IP Stacks (Ethernut CVE-2026-120596, PicoTCP, Contiki, wolfIP)

Detects Zeek protocol-anomaly (weird) events for malformed TCP options, bad TCP header lengths, IP fragment and IP option anomalies, and ICMPv6 extension-header issues sent to OT/IoT subnets. These are the trigger classes for the Ethernut Nut/OS zero-length TCP option infinite loop (CVE-2026-120596, a single segment hangs TCP processing), the PicoTCP IP fragment reassembly heap overflow (FSCT-2026-0017), the wolfIP ESP IP-options underflow (FSCT-2026-0012) and the Contiki RPL/ICMPv6 parsing flaws (FSCT-2026-0013, -0015). Each is a single unauthenticated packet.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1498, T1499, T1210
• Data sources: zeek:weird (index=zeek sourcetype=bro:weird:json), CommonSecurityLog (firewall/IPS CEF)
• Severity: high
• Confidence: medium

Splunk SPL

index=zeek sourcetype="bro:weird:json" earliest=-24h
```Malformed packets aimed at embedded stacks: TCP option, IP fragment, IP option and ICMPv6 anomalies (CVE-2026-120596, FSCT-2026-0017, FSCT-2026-0012)```
| rename "id.orig_h" as src_ip, "id.resp_h" as dest_ip, "id.resp_p" as dest_port
| where cidrmatch("10.20.0.0/16", dest_ip)
| eval weird_l=lower(name)
| where match(weird_l, "tcp.*opt|bad_tcp_header|fragment|bad_ip_hdr|ip_opt|ext_hdr|icmp6|icmpv6|truncated_header|bad_icmp")
| stats count as events, dc(name) as distinct_anomalies, values(name) as anomalies, values(dest_port) as dest_ports, min(_time) as first_seen, max(_time) as last_seen by src_ip, dest_ip
| convert ctime(first_seen) ctime(last_seen)
| sort - events

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where ipv4_is_in_range(DestinationIP, "10.20.0.0/16")
| where Activity matches regex @"(?i)(tcp.?option|malformed|invalid.?(ip|tcp|icmp)|fragment|overlap|bad.?header)"
| summarize Events=count(), Anomalies=make_set(Activity, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP
| order by Events desc

Sigma

title: Malformed TCP/IP Packets Targeting Embedded Stacks in OT Subnets
id: c19d4e70-82fa-4a3b-b6c7-0f5e9d1a7b38
status: experimental
description: Detects Zeek weird events for malformed TCP options, IP fragments, IP options and ICMPv6 headers toward OT subnets. Trigger classes for Ethernut CVE-2026-120596 (zero-length TCP option loop) and Forescout FSCT-2026-0012/0013/0015/0017 parsing flaws in wolfIP, Contiki and PicoTCP.
references:
  - https://www.forescout.com/research-labs/finding-critical-infrastructure-bugs-with-off-the-shelf-ai/
  - https://productcert.siemens.com/productcert/html/ssa-333035.html
author: Threadlinqs Team
date: 2026/11/13
tags:
  - attack.impact
  - attack.t1498
  - attack.t1499
  - attack.lateral-movement
  - attack.t1210
  - cve.2026-120596
logsource:
  product: zeek
  service: weird
detection:
  sel_dest:
    id.resp_h|cidr: '10.20.0.0/16'
  sel_name:
    name|contains:
      - 'tcp_opt'
      - 'bad_tcp_header'
      - 'fragment'
      - 'bad_ip_hdr'
      - 'ip_opt'
      - 'ext_hdr'
      - 'icmp6'
      - 'icmpv6'
      - 'truncated_header'
      - 'bad_icmp'
  condition: sel_dest and sel_name
falsepositives:
  - Network equipment or middleboxes that fragment or mangle packets
  - Port scanners and network tests producing malformed packets
level: medium

Known false positives:

• Fragmentation caused by VPN tunnels, MTU mismatches or middleboxes
• Network scanners and protocol conformance testers producing anomalous packets

Tuning notes: Zeek weird names vary by version; review names in your environment and adjust the regex. Replace 10.20.0.0/16 with real OT/IoT CIDRs. Suppress known noisy sources after review, and alert on any single event to a controller that later becomes unresponsive (see TL-2026-5964-KQL-001).

• 🔒 OT Controller Sudden Unanswered Connections Indicating TCP Stack Hang or Service Crash (CVE-2026-120596, CVE-2026-102073..102076) · unlock with TL Creds
• 🔒 First-Seen Source Reaching Controller FTP/Web Services (Exposed Nucleus NET Services, CVE-2026-102073..102076) · unlock with TL Creds
• 🔒 Single Source Probing Many OT Controllers on FTP/Web/BACnet/S7 Ports (Pre-Exploitation Reconnaissance of Nucleus NET Devices) · unlock with TL Creds
• 🔒 Vulnerability-Research Tooling Execution: Joern, Ghidra Headless, Semgrep (AI-Assisted Harness Tooling) · unlock with TL Creds
• 🔒 Embedded Firmware Emulation and Packet-Crafting Tooling: QEMU System Emulators, gdb-multiarch, Scapy, boofuzz, AFL (Exploit Development for TCP/IP Stack Flaws) · unlock with TL Creds
• 🔒 DNS Resolution of Generative AI API Endpoints from Non-Approved Segments (AI-Assisted Vulnerability Research Harness Egress) · unlock with TL Creds
• 🔒 OT Controller Oversized Web Upload / Multipart Request (Nucleus NET CVE-2026-102073, CVE-2026-102075, CVE-2026-102076) · unlock with TL Creds
• 🔒 OT Controller Oversized FTP Command Argument (Nucleus NET FTP Stack Overflow CVE-2026-102074) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5964.

Technical analysis

No in-the-wild exploitation or public PoC release is stated.

Forescout Research (Vedere Labs; authors Stanislav Dashevskyi, Francesco La Spina, Daniel dos Santos) tested whether generally available AI models, on a limited budget, can find vulnerabilities in open-source and binary-only targets relevant to critical infrastructure. The work extends Project Memoria (2020-2021), Forescout's manual study of TCP/IP stacks (AMNESIA:33, NUMBER:JACK, NAME:WRECK, INFRA:HALT, NUCLEUS:13).

Methodology: a custom harness mixing deterministic and AI-driven stages. Stage 0 has AI identify artifact type, architecture, endianness and load address, rename stripped functions and convert binaries with Ghidra. Stage 1 is deterministic discovery with Semgrep and Joern (code property graph) using 32 Joern rules (buffer overflow 7, integer overflow 9, DNS RR processing per RFC 9267 5, memory safety/protocol parsing 5, ICMPv6 extension header parsing 2, uninitialized memory/weak randomness 2, abort/assert 1, NULL dereference 1). Stage 2 checks reachability from attacker input, stage 3 has AI agents judge exploitability, and stage 4 performs dynamic verification by building or emulating the target and generating proof-of-concept scripts. Claude Sonnet 4.6 was used for stages 0-3 and Claude Opus models (between 4.6 and 5) for dynamic verification. The authors report roughly $935 for static analysis of 362 candidate findings (about $2.58 per finding), about 10 hours of wall-clock time for stages 1-3 and about 80 hours of dynamic validation, with total model spend of roughly $1,200-$2,300.

Results: 312 candidates produced 99 confirmed vulnerabilities in about 90 hours: 33 rediscovered from the 82 known Memoria vulnerabilities and 66 new, of which 54 were reported to vendors or maintainers (20 open-source, 34 proprietary). 52% of new findings are critical or high severity and 29% affect core TCP/IP components. Classes across all 99: 48 memory corruption, 27 integer issues, 16 input validation and 8 control-flow or logic. The harness was strongest at memory-safety and protocol-parsing bugs and missed logic/design bugs (ISN predictability, weak PRNG, DNS cache poisoning, TCP state machine). Stacks tested: Contiki v3.0, Ethernut v5.1, FNET v4.6.3, PicoTCP v1.7.0, Nucleus NET v5.1, lwIP v2.2.1, wolfIP v1.0, and undisclosed binary stacks S1, S2 and S3.

Assigned CVEs: Siemens advisory SSA-333035 (published 2026-10-13, overall CVSS v3.1 8.2 / v4.0 8.8) covers five Nucleus NET CVEs in APOGEE, TALON and Desigo PXC/PXM controllers: CVE-2026-89208 (CWE-125 out-of-bounds read, CVSS 5.3), CVE-2026-102073 (CWE-191 integer underflow in the web service, memory read or DoS, CVSS 8.2) and CVE-2026-102074, -102075, -102076 (CWE-121 stack-based overflows in the FTP service, web multipart handling and web upload code, DoS, CVSS 7.5). Siemens states the FTP/Web services are disabled by default. CVE-2026-120596 is an Ethernut Nut/OS TCP options parser infinite loop on a zero-length unknown option, hanging TCP processing with one segment to any open TCP port; Ethernut has not responded. CVEs for the open-source findings (FSCT-2026-0006 to -0025 across lwIP, wolfIP, Contiki, PicoTCP and FNET) are pending from MITRE. Examples include a Contiki RPL DIO prefix-length stack overflow (FSCT-2026-0015), a PicoTCP IP fragment reassembly heap overflow (FSCT-2026-0017), a wolfIP ESP IP-options memmove underflow (FSCT-2026-0012) and an lwIP SMTP client buffer overflow (FSCT-2026-0008).

Status: fixes exist for Contiki (contiki-ng PRs #3256-#3258, #3282), FNET (PR #20), PicoTCP (PR #81), wolfIP (commits 8bfdb80, b9e84e3), lwIP (three commits) and Nucleus NET (SSA-333035; no fix planned for APOGEE MBC/MEC and for Desigo PXC devices affected by CVE-2026-89208). S1-S3 are under investigation; S1 is embedded in firmware of a discontinued wireless access point from a defunct company, so a patch may never arrive. No exploitation in the wild is stated and Forescout does not state a public PoC release; the research is defender-oriented and demonstrates that the cost and time to discover such bugs has fallen sharply.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities; T1588.007 Obtain Capabilities: Artificial Intelligence

Remediation

Patches

• Siemens SSA-333035 firmware updates via the Siemens Partner Portal
• contiki-ng PRs #3256, #3257, #3258, #3282
• butok/FNET PR #20
• virtualsquare/picotcp PR #81
• wolfSSL/wolfip commits 8bfdb80 and b9e84e3
• lwIP commits 81bfe390504a0eb367316ff048545624ab2cd0e0, 89b823ce9a062bf6e99cd882de99322402a112fe, 9670da2c6b6658e5811a9af93e0ee6222f3ad8a4

Immediate actions

• Apply Siemens SSA-333035 updates: APOGEE PXC Compact/Modular BACnet and TALON TC Compact/Modular BACnet to V3.5.7 or later; APOGEE PXC Compact/Modular P2 Ethernet to V2.8.21 or later
• Disable the FTP/Web service on APOGEE, Desigo and TALON controllers (disabled by default per Siemens) to mitigate CVE-2026-102073..102076
• Restrict high-risk services (FTP, Telnet, IPv6, web admin interfaces) and point devices at internal DNS rather than external resolvers
• Isolate devices that cannot be patched in tightly restricted segments and allow only required traffic

Workarounds

• Disable FTP and web services on affected controllers
• Segment OT networks and filter malformed IP fragments, IP options and TCP options at boundary devices where feasible
• Ethernut (no vendor response): isolate affected devices and restrict reachability of open TCP ports

Longer-term hardening

• Place controllers behind properly configured gateways or firewalls with network segmentation (Siemens guidance for CVE-2026-89208)
• Replace end-of-life devices with no planned fix (APOGEE MBC/MEC, affected Desigo PXC models, devices embedding S1)
• Use brokered, least-privilege remote access instead of flat VPN access and shared credentials
• Build security into procurement: support lifetimes, vulnerability disclosure policy, SBOMs and evidence of ongoing (including AI-assisted) security testing
• Vendors and maintainers: add AI-assisted static analysis to pipelines and rerun variant analysis on previously audited code

Affected and fixed versions

• Siemens — APOGEE PXC Compact/Modular BACnet, TALON TC Compact/Modular BACnet (Nucleus NET)
  Vulnerable versions: < V3.5.7
  Fixed in: V3.5.7 or later
• Siemens — APOGEE PXC Compact/Modular P2 Ethernet (Nucleus NET)
  Vulnerable versions: < V2.8.21
  Fixed in: V2.8.21 or later
• Siemens — APOGEE MBC (PPC) and MEC (PPC) BACnet / P2 Ethernet
  Vulnerable versions: All versions
  Fixed in: No fix planned
• Siemens — Desigo PXC00-E.D, PXC00-U, PXC001-E.D, PXC12-E.D, PXC22-E.D, PXC22.1-E.D, PXC36.1-E.D, PXC50-E.D, PXC64-U, PXC100-E.D, PXC128-U, PXC200-E.D, PXM20-E (CVE-2026-89208 only)
  Vulnerable versions: All versions >= V2.3
  Fixed in: No fix planned
• Siemens / Mentor — Nucleus NET TCP/IP stack
  Vulnerable versions: v5.1 (tested)
  Fixed in: Per SSA-333035
• Ethernut — Nut/OS Ethernut TCP/IP stack
  Vulnerable versions: v5.1
• Contiki-NG / Contiki — Contiki TCP/IP (uIP, ip64, RPL)
  Vulnerable versions: v3.0
  Fixed in: Fixed via contiki-ng PRs #3256-#3258, #3282
• FNET — FNET TCP/IP stack
  Vulnerable versions: v4.6.3
  Fixed in: Fixed via FNET PR #20
• PicoTCP — PicoTCP
  Vulnerable versions: v1.7.0
  Fixed in: Fixed via picotcp PR #81
• lwIP — lwIP
  Vulnerable versions: v2.2.1
  Fixed in: Fixed via three upstream commits

Timeline

• 2020-12-08 Forescout publishes AMNESIA:33, the first Project Memoria study (33 memory-corruption flaws in open-source TCP/IP stacks including uIP, FNET, PicoTCP and Nut/Net)
• 2021-02-10 NUMBER:JACK published: 9 flaws in how TCP/IP stacks generate Initial Sequence Numbers
• 2021-04-13 NAME:WRECK published with JSOF: 9 DNS-related flaws in 4 popular stacks
• 2021-08-04 INFRA:HALT published with JFrog: 14 flaws in the closed-source NicheStack
• 2021-11-09 NUCLEUS:13 published with Medigate Labs: 13 flaws in the Nucleus TCP/IP stack, concluding Project Memoria (about 18 months, five phases)
• 2026-10-13 Siemens publishes SSA-333035 (V1.0) covering Nucleus NET CVE-2026-89208 and CVE-2026-102073..102076 in APOGEE, TALON and Desigo PXC/PXM controllers; NVD publishes CVE-2026-89208 the same day
• 2026-10-15 NVD last modifies CVE-2026-89208 (status Awaiting Analysis)

Sources cited

• NVD: CVE-2026-89208 NVD (NIST) · Advisory · 2026-10-13
• Finding Critical Infrastructure Bugs with Off-the-Shelf AI (Forescout Research - Vedere Labs) forescout.com · Research
• Siemens SSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products productcert.siemens.com · Vendor report · 2026-10-13
• Forescout Project Memoria forescout.com · Research · 2021-11-09
• contiki-ng fix PR #3256 GitHub · Code repository
• FNET fix PR #20 GitHub · Code repository
• PicoTCP fix PR #81 GitHub · Code repository
• wolfIP fix commit 8bfdb80 GitHub · Code repository
• Semgrep: Comparing open-source AI code security harnesses semgrep.dev · Blog

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)
• Check Point Gaia/Mobile Access Exploitation (CVE-2026-109618, CVE-2026-109619, CVE-2026-123039) Leads to Root Access and destroy_v6 Wiper Deployment on VMware ESXi