Race Condition Vulnerability in KUNBUS piControl by Nozomi Networks
CVE-2026-13198

5.9MEDIUM

Key Information:

Vendor

Kunbus

Status
Picontrol
Vendor
CVE Published:
14 August 2026

What is CVE-2026-13198?

A race condition vulnerability exists in the event notification functionality of KUNBUS piControl version 2.6.2. This flaw arises from improper synchronization when multiple threads issue crafted requests simultaneously. An authenticated attacker can exploit this vulnerability to corrupt the kernel heap and event-list state, potentially disclosing adjacent kernel memory, leading to memory corruption and denial of service.

Affected Version(s)

piControl 0 <= 2.6.2

References

https://www.nozominetworks.com/labs/vulnerability-advisor...
third-party-advisory

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriele Quagliarella at Nozomi Networks
.