Description
P-Net before 1.0.4 routes a received RTA alarm frame to an Application Relationship using only the destination alarm reference in the frame, without checking the source of the frame. A host with ADJACENT network access can abort an established Application Relationship with a single alarm ERROR frame, or deliver forged alarm notifications with chosen type, slot, subslot, USI and payload to the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| RT-Labs | P-Net | 0 <1.0.4 | — |
| RT-Labs | P-Net | 1.0.4 <* | — |