Network Fragmentation Vulnerability in P-Net by RT-Labs

CVE-2026-127125

What is CVE-2026-127125?

The P-Net software, prior to version 1.0.4, is affected by a vulnerability that occurs when a response fragment is resent without proper acknowledgment, leading to the abrupt termination of the Application Relationship in an RPC session. This situation arises when a request for an existing Application Relationship mistakenly uses a session without one due to a fragmented response. When such an unacknowledged response is processed, it can lead to a NULL pointer dereference, ultimately causing the device to crash. An attacker must have adjacent network access and must have observed the Application Relationship UUID to exploit this vulnerability.

References