# Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)

> Forescout Vedere Labs used a custom AI-assisted harness (Claude models plus Ghidra, Semgrep and Joern) to confirm 99 vulnerabilities across 10 embedded TCP/IP stacks, 66 of them new and 52% of those rated critical or high. Affected stacks include Nucleus NET (Siemens APOGEE, TALON and Desigo PXC controllers), Contiki, Ethernut, FNET, PicoTCP, lwIP, wolfIP and three undisclosed closed-source stacks. No in-the-wild exploitation or public PoC release is stated.

- **Published:** 2026-11-13T13:13:19Z
- **Last reviewed:** 2026-11-13T13:13:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5964
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5964.png
- **ID:** TL-2026-5964
- **Severity:** HIGH (CVSS 8.2)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 16
- **CVEs:** CVE-2026-120596, CVE-2026-89208, CVE-2026-102073, CVE-2026-102074, CVE-2026-102075, CVE-2026-102076

## Description

Forescout Research (Vedere Labs; authors Stanislav Dashevskyi, Francesco La Spina, Daniel dos Santos) tested whether generally available AI models, on a limited budget, can find vulnerabilities in open-source and binary-only targets relevant to critical infrastructure. The work extends Project Memoria (2020-2021), Forescout's manual study of TCP/IP stacks (AMNESIA:33, NUMBER:JACK, NAME:WRECK, INFRA:HALT, NUCLEUS:13).

Methodology: a custom harness mixing deterministic and AI-driven stages. Stage 0 has AI identify artifact type, architecture, endianness and load address, rename stripped functions and convert binaries with Ghidra. Stage 1 is deterministic discovery with Semgrep and Joern (code property graph) using 32 Joern rules (buffer overflow 7, integer overflow 9, DNS RR processing per RFC 9267 5, memory safety/protocol parsing 5, ICMPv6 extension header parsing 2, uninitialized memory/weak randomness 2, abort/assert 1, NULL dereference 1). Stage 2 checks reachability from attacker input, stage 3 has AI agents judge exploitability, and stage 4 performs dynamic verification by building or emulating the target and generating proof-of-concept scripts. Claude Sonnet 4.6 was used for stages 0-3 and Claude Opus models (between 4.6 and 5) for dynamic verification. The authors report roughly $935 for static analysis of 362 candidate findings (about $2.58 per finding), about 10 hours of wall-clock time for stages 1-3 and about 80 hours of dynamic validation, with total model spend of roughly $1,200-$2,300.

Results: 312 candidates produced 99 confirmed vulnerabilities in about 90 hours: 33 rediscovered from the 82 known Memoria vulnerabilities and 66 new, of which 54 were reported to vendors or maintainers (20 open-source, 34 proprietary). 52% of new findings are critical or high severity and 29% affect core TCP/IP components. Classes across all 99: 48 memory corruption, 27 integer issues, 16 input validation and 8 control-flow or logic. The harness was strongest at memory-safety and protocol-parsing bugs and missed logic/design bugs (ISN predictability, weak PRNG, DNS cache poisoning, TCP state machine). Stacks tested: Contiki v3.0, Ethernut v5.1, FNET v4.6.3, PicoTCP v1.7.0, Nucleus NET v5.1, lwIP v2.2.1, wolfIP v1.0, and undisclosed binary stacks S1, S2 and S3.

Assigned CVEs: Siemens advisory SSA-333035 (published 2026-10-13, overall CVSS v3.1 8.2 / v4.0 8.8) covers five Nucleus NET CVEs in APOGEE, TALON and Desigo PXC/PXM controllers: CVE-2026-89208 (CWE-125 out-of-bounds read, CVSS 5.3), CVE-2026-102073 (CWE-191 integer underflow in the web service, memory read or DoS, CVSS 8.2) and CVE-2026-102074, -102075, -102076 (CWE-121 stack-based overflows in the FTP service, web multipart handling and web upload code, DoS, CVSS 7.5). Siemens states the FTP/Web services are disabled by default. CVE-2026-120596 is an Ethernut Nut/OS TCP options parser infinite loop on a zero-length unknown option, hanging TCP processing with one segment to any open TCP port; Ethernut has not responded. CVEs for the open-source findings (FSCT-2026-0006 to -0025 across lwIP, wolfIP, Contiki, PicoTCP and FNET) are pending from MITRE. Examples include a Contiki RPL DIO prefix-length stack overflow (FSCT-2026-0015), a PicoTCP IP fragment reassembly heap overflow (FSCT-2026-0017), a wolfIP ESP IP-options memmove underflow (FSCT-2026-0012) and an lwIP SMTP client buffer overflow (FSCT-2026-0008).

Status: fixes exist for Contiki (contiki-ng PRs #3256-#3258, #3282), FNET (PR #20), PicoTCP (PR #81), wolfIP (commits 8bfdb80, b9e84e3), lwIP (three commits) and Nucleus NET (SSA-333035; no fix planned for APOGEE MBC/MEC and for Desigo PXC devices affected by CVE-2026-89208). S1-S3 are under investigation; S1 is embedded in firmware of a discontinued wireless access point from a defunct company, so a patch may never arrive. No exploitation in the wild is stated and Forescout does not state a public PoC release; the research is defender-oriented and demonstrates that the cost and time to discover such bugs has fallen sharply.

## MITRE ATT&CK

- T1587.004 Develop Capabilities: Exploits
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1190 Exploit Public-Facing Application

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Malformed TCP Options, IP Fragments and IPv6/ICMPv6 Headers Reaching Embedded TCP/IP Stacks (Ethernut CVE-2026-120596, PicoTCP, Contiki, wolfIP)** (`TL-2026-5964-SPL-003`)

Detects Zeek protocol-anomaly (weird) events for malformed TCP options, bad TCP header lengths, IP fragment and IP option anomalies, and ICMPv6 extension-header issues sent to OT/IoT subnets. These are the trigger classes for the Ethernut Nut/OS zero-length TCP option infinite loop (CVE-2026-120596, a single segment hangs TCP processing), the PicoTCP IP fragment reassembly heap overflow (FSCT-2026-0017), the wolfIP ESP IP-options underflow (FSCT-2026-0012) and the Contiki RPL/ICMPv6 parsing flaws (FSCT-2026-0013, -0015). Each is a single unauthenticated packet.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1498, T1499, T1210
- **Data sources:** zeek:weird (index=zeek sourcetype=bro:weird:json), CommonSecurityLog (firewall/IPS CEF)
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=zeek sourcetype="bro:weird:json" earliest=-24h
```Malformed packets aimed at embedded stacks: TCP option, IP fragment, IP option and ICMPv6 anomalies (CVE-2026-120596, FSCT-2026-0017, FSCT-2026-0012)```
| rename "id.orig_h" as src_ip, "id.resp_h" as dest_ip, "id.resp_p" as dest_port
| where cidrmatch("10.20.0.0/16", dest_ip)
| eval weird_l=lower(name)
| where match(weird_l, "tcp.*opt|bad_tcp_header|fragment|bad_ip_hdr|ip_opt|ext_hdr|icmp6|icmpv6|truncated_header|bad_icmp")
| stats count as events, dc(name) as distinct_anomalies, values(name) as anomalies, values(dest_port) as dest_ports, min(_time) as first_seen, max(_time) as last_seen by src_ip, dest_ip
| convert ctime(first_seen) ctime(last_seen)
| sort - events
````

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where ipv4_is_in_range(DestinationIP, "10.20.0.0/16")
| where Activity matches regex @"(?i)(tcp.?option|malformed|invalid.?(ip|tcp|icmp)|fragment|overlap|bad.?header)"
| summarize Events=count(), Anomalies=make_set(Activity, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP
| order by Events desc
```

### Sigma

```yaml
title: Malformed TCP/IP Packets Targeting Embedded Stacks in OT Subnets
id: c19d4e70-82fa-4a3b-b6c7-0f5e9d1a7b38
status: experimental
description: Detects Zeek weird events for malformed TCP options, IP fragments, IP options and ICMPv6 headers toward OT subnets. Trigger classes for Ethernut CVE-2026-120596 (zero-length TCP option loop) and Forescout FSCT-2026-0012/0013/0015/0017 parsing flaws in wolfIP, Contiki and PicoTCP.
references:
  - https://www.forescout.com/research-labs/finding-critical-infrastructure-bugs-with-off-the-shelf-ai/
  - https://productcert.siemens.com/productcert/html/ssa-333035.html
author: Threadlinqs Team
date: 2026/11/13
tags:
  - attack.impact
  - attack.t1498
  - attack.t1499
  - attack.lateral-movement
  - attack.t1210
  - cve.2026-120596
logsource:
  product: zeek
  service: weird
detection:
  sel_dest:
    id.resp_h|cidr: '10.20.0.0/16'
  sel_name:
    name|contains:
      - 'tcp_opt'
      - 'bad_tcp_header'
      - 'fragment'
      - 'bad_ip_hdr'
      - 'ip_opt'
      - 'ext_hdr'
      - 'icmp6'
      - 'icmpv6'
      - 'truncated_header'
      - 'bad_icmp'
  condition: sel_dest and sel_name
falsepositives:
  - Network equipment or middleboxes that fragment or mangle packets
  - Port scanners and network tests producing malformed packets
level: medium
```

**Known false positives:**

- Fragmentation caused by VPN tunnels, MTU mismatches or middleboxes
- Network scanners and protocol conformance testers producing anomalous packets

**Tuning notes:** Zeek weird names vary by version; review names in your environment and adjust the regex. Replace 10.20.0.0/16 with real OT/IoT CIDRs. Suppress known noisy sources after review, and alert on any single event to a controller that later becomes unresponsive (see TL-2026-5964-KQL-001).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- OT Controller Sudden Unanswered Connections Indicating TCP Stack Hang or Service Crash (CVE-2026-120596, CVE-2026-102073..102076) (locked: unlock with TL Creds)
- First-Seen Source Reaching Controller FTP/Web Services (Exposed Nucleus NET Services, CVE-2026-102073..102076) (locked: unlock with TL Creds)
- Single Source Probing Many OT Controllers on FTP/Web/BACnet/S7 Ports (Pre-Exploitation Reconnaissance of Nucleus NET Devices) (locked: unlock with TL Creds)
- Vulnerability-Research Tooling Execution: Joern, Ghidra Headless, Semgrep (AI-Assisted Harness Tooling) (locked: unlock with TL Creds)
- Embedded Firmware Emulation and Packet-Crafting Tooling: QEMU System Emulators, gdb-multiarch, Scapy, boofuzz, AFL (Exploit Development for TCP/IP Stack Flaws) (locked: unlock with TL Creds)
- DNS Resolution of Generative AI API Endpoints from Non-Approved Segments (AI-Assisted Vulnerability Research Harness Egress) (locked: unlock with TL Creds)
- OT Controller Oversized Web Upload / Multipart Request (Nucleus NET CVE-2026-102073, CVE-2026-102075, CVE-2026-102076) (locked: unlock with TL Creds)
- OT Controller Oversized FTP Command Argument (Nucleus NET FTP Stack Overflow CVE-2026-102074) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Finding Critical Infrastructure Bugs with Off-the-Shelf AI (Forescout Research - Vedere Labs)](https://www.forescout.com/research-labs/finding-critical-infrastructure-bugs-with-off-the-shelf-ai/)
- [Siemens SSA-333035: Multiple Vulnerabilities in APOGEE, TALON and Desigo PXC/PXM Products](https://productcert.siemens.com/productcert/html/ssa-333035.html)
- [NVD: CVE-2026-89208](https://nvd.nist.gov/vuln/detail/CVE-2026-89208)
- [Forescout Project Memoria](https://www.forescout.com/research-labs/project-memoria/)
- [contiki-ng fix PR #3256](https://github.com/contiki-ng/contiki-ng/pull/3256)
- [FNET fix PR #20](https://github.com/butok/FNET/pull/20)
- [PicoTCP fix PR #81](https://github.com/virtualsquare/picotcp/pull/81)
- [wolfIP fix commit 8bfdb80](https://github.com/wolfSSL/wolfip/commit/8bfdb80)
- [Semgrep: Comparing open-source AI code security harnesses](https://semgrep.dev/blog/2026/comparing-open-source-ai-code-security-harnesses/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5964