OTPulse

lwIP (Lightweight IP)

Plan PatchCVSS 8.8ICS-CERT ICSA-26-265-02Sep 22, 2026
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

lwIP versions 2.0.1 through 2.2.1 contain a use-after-free vulnerability (CWE-415) in packet processing that can result in system crash, denial of service, or memory corruption leading to potential code execution. The vulnerability is triggered by specially crafted network packets and requires only network access with no authentication. The fix is available in the lwIP repository at commit f873b6295933e4149a2132adf3e9a2d2a676a5ec.

What this means
What could happen
An attacker with network access to a device running vulnerable lwIP could cause the device to crash, become unresponsive, or potentially execute arbitrary code, disrupting communication and control functions for that system.
Who's at risk
This affects any OT/ICS devices or embedded systems that use lwIP as their TCP/IP stack, including industrial gateways, programmable logic controllers (PLCs), remote terminal units (RTUs), and other networked embedded controllers. Any device running lwIP versions 2.0.1 through 2.2.1 is vulnerable.
How it could be exploited
An attacker on the same network segment sends specially crafted network packets to the device running vulnerable lwIP. The vulnerability in packet processing causes memory corruption or a denial-of-service condition, potentially allowing code execution if memory is corrupted in a exploitable way.
Prerequisites
  • Network access to the device (same network segment or routable path)
  • Device must be running lwIP version 2.0.1 through 2.2.1
remotely exploitablelow complexityno authentication requiredaffects embedded control systemscan cause denial of service or memory corruption
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (1)
ProductAffected VersionsFix Status
API: >=2.0.1|<=2.2.1≥ 2.0.1|≤ 2.2.1No fix yet
Remediation & Mitigation
0/3
Do now
0/1
HARDENINGIsolate devices running vulnerable lwIP versions from untrusted networks using network segmentation or firewall rules
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate lwIP to the patched version containing commit f873b6295933e4149a2132adf3e9a2d2a676a5ec or later from https://cgit.git.savannah.gnu.org/cgit/lwip.git
Long-term hardening
0/1
HARDENINGMonitor network traffic to and from devices using lwIP for anomalous packet patterns
View full CISA ICS-CERT advisory
API: /api/v1/advisories/6c3c4cc5-677a-409c-a053-fd1af6736094

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.