lwIP (Lightweight IP) (CVE-2026-91018)
A double free vulnerability in lwIP versions 2.0.1 through 2.2.1 enables system crash, DoS, memory corruption, or code execution on adjacent network ICS devices. lwIP (Lightweight IP) versions 2.0.1 through 2.2.1 contain a double free flaw (CWE-415) rated CVSS 8.8 HIGH. Exploitation requires adjacent network access, not remote, and can crash systems or achieve code execution. A fix is available in commit f873b6295933e4149a2132adf3e9a2d2a676a5ec.
Detection / Hunteropenrouter
Immediate Actions
- Update lwIP to the latest version from the official repository
- Apply fix commit f873b6295933e4149a2132adf3e9a2d2a676a5ec
- Isolate control system networks from business networks
Key Takeaways
- Affected versions: lwIP API >=2.0.1 through <=2.2.1
- CVSS 3.1 score 8.8 HIGH; CVSS 4.0 score 8.7 HIGH
- Attack vector is adjacent network (AV:A), not remote
- Fix commit: f873b6295933e4149a2132adf3e9a2d2a676a5ec
- Reported by Eric Evenchick of Tetrel Security
- No known public exploitation reported as of 2026-09-22
Attack Chain
- Vulnerability: lwIP versions 2.0.1–2.2.1 contain a double free flaw in the networking stack
- Access: Attacker requires adjacent network access to the target system
- Exploitation: Triggering the double free causes memory corruption or system crash
- Impact: Denial of service, memory corruption, or potential code execution on victim system
Affected Systems
- lwIP API versions 2.0.1 through 2.2.1
- Industrial control systems using lwIP
- Embedded devices with lwIP networking stack
- Chemical sector control systems
- Energy sector control systems
- Water and wastewater systems
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-91018 | lwIP (Lightweight IP) | High | Double free vulnerability allows system crash, DoS, memory corruption, or code execution. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | lwIP runs on embedded devices and ICS controllers where EDR agents are typically absent. |
| Network Visibility | Medium | Adjacent network exploitation may produce anomalous traffic to lwIP devices, but no specific signatures are published. |
| Detection Difficulty | Hard | Embedded lwIP devices lack standard logging and EDR coverage; double free exploitation produces no distinctive network signature. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Anomalous or malformed network packets sent to embedded devices triggering crashes or reboots may indicate exploitation attempts (T1499.004). | Network flow logs, IDS alerts, device uptime logs | Impact | Medium — legitimate network scans or misconfigurations can crash unstable lwIP implementations. |
Required Log Sources
- Network flow logs
- ICS firewall logs
- Embedded device system logs
- Network IDS alerts
Key Behavioral Indicators
- Unexpected device reboots or crashes on lwIP-based systems
- Anomalous adjacent-network traffic to embedded controllers
- Memory corruption symptoms on lwIP networking devices
Control Gaps
- Embedded devices lack EDR or host-based logging
- No published IDS/IPS signatures for this double free
- ICS network segmentation often incomplete
False Positive Assessment
Low — vulnerability is specific to lwIP versions 2.0.1–2.2.1; exploitation indicators are device crashes or anomalous adjacent network traffic.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block unauthorized adjacent network access to lwIP devices
- Place control system networks behind firewalls
- Use VPNs for required remote access to ICS networks
- Minimize network exposure for all control system devices
User Protection
- Restrict physical and network access to embedded lwIP devices
- Monitor for unexpected device crashes or reboots
Security Awareness
- Do not click web links or open attachments in unsolicited emails
- Report suspected malicious activity to CISA for tracking
MITRE ATT&CK Mapping
Plain-Language Summary
A flaw in a widely used networking library called lwIP could let an attacker crash embedded devices or run malicious code on them. The library is used in industrial control systems worldwide across sectors like energy, water, and manufacturing. Organizations should update lwIP to the latest version from the official repository and isolate control system networks from the internet.
- cveCVE-2026-91018Double free vulnerability allows system crash, DoS, memory corruption, or code execution.