CVE-2026-112200: Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P-Netto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Devices using P-Net versions before 1.0.3 are affected. The issue is reachable remotely through RPC requests, and no authentication or user interaction is required.
What must an attacker do to trigger the condition?
An attacker must repeatedly send RPC requests whose data representation uses incorrect endianness. Each rejected request leaves an Application Relationship and RPC session allocated, eventually exhausting available sessions.
What is the operational impact after sessions are exhausted?
The device stops answering new RPC requests, including Connect requests. Service is restored only by restarting the device.
What can be done if an update cannot be applied immediately?
The provided information does not identify a workaround. Because exploitation requires remote RPC access, limiting untrusted network access to the device's RPC interface may reduce exposure.