CVE-2026-111733: NULL pointer dereference on implicit read of AR specific record index
P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot). A remote unauthenticated attacker can send such a request to crash the device (denial of service).
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P-Netto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
Which systems are exposed to remote exploitation?
Devices using P-Net versions before 1.0.3 are exposed if they can receive implicit read requests from a remote attacker. Exploitation does not require authentication or user interaction.
What does an attacker need to send to trigger the failure?
The attacker must send an implicit read request with no valid target AR UUID for an AR-specific record index in the 0xE000-0xEFFF range, or for expected identification data of a slot or subslot. The malformed request causes P-Net to dereference a NULL AR pointer.
What is the practical impact of successful exploitation?
Successful exploitation crashes the affected device, resulting in a denial of service. The provided information does not indicate confidentiality or integrity impact.