CVE-2026-115793: Resource exhaustion from RPC sessions kept for requests to unknown interface
P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P-Netto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
Which systems are exposed to this denial of service?
P-Net versions before 1.0.3 are affected. Affected devices can stop answering new RPC requests after their available RPC sessions are exhausted.
Does exploitation require authentication or user interaction?
No. A remote attacker can trigger the issue without authentication or user interaction by sending RPC requests that reference an unknown interface or object UUID.
What attack pattern exhausts the device's RPC sessions?
The attacker repeatedly sends requests using different activity UUIDs for an unknown interface or object UUID. The allocated sessions are not released and no timeout is started for them.
What is the operational impact once sessions are exhausted?
The device no longer responds to new RPC requests, including Endpoint Mapper Lookup and Connect. It remains unavailable for those requests until restarted.
What can be done if an affected device cannot be updated immediately?
The provided information identifies restarting the device as the way to recover after session exhaustion. It does not provide a documented mitigation for preventing exploitation before updating to version 1.0.3 or later.