CVE-2026-127123
Fragment with another data representation releases an Application Relationship
Description
P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not told that the Application Relationship is gone, the cyclic data stops, and the resources of the Application Relationship are left referencing a cleared structure. Another host can then connect in its place. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can do this with one PDU.
INFO
Published Date :
Nov. 13, 2026, 1:25 p.m.
Last Modified :
Nov. 13, 2026, 1:25 p.m.
Remotely Exploit :
No
Source :
rt-labs
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | MEDIUM | 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee |
Solution
- Update P-Net to version 1.0.4.
- Ensure the abort procedure is implemented.
- Verify data representation consistency.
- Monitor network access.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-127123 vulnerability anywhere in the article.