Skip to content
OpenAdvisories
Medium · 6.0 CVE-2026-127123 EUVD-2026-125303GHSA-v2w8-x348-r25p

Fragment with another data representation releases an Application Relationship

Published Nov 13, 2026 · Updated Nov 13, 2026 · Assigned by rt-labs

Description

P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not told that the Application Relationship is gone, the cyclic data stops, and the resources of the Application Relationship are left referencing a cleared structure. Another host can then connect in its place. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can do this with one PDU.

Affected products

VendorProductAffectedFixed
RT-Labs P-Net < 1.0.4 1.0.4

References