CVE-2026-124759: Alarm frames are accepted from any source address
P-Net before 1.0.4 routes a received RTA alarm frame to an Application Relationship using only the destination alarm reference in the frame, without checking the source of the frame. A host with ADJACENT network access can abort an established Application Relationship with a single alarm ERROR frame, or deliver forged alarm notifications with chosen type, slot, subslot, USI and payload to the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
P-Net versions before 1.0.4 are affected when they have an established Application Relationship and can receive alarm frames from an adjacent network host. The attacker does not need credentials or user interaction.
What can an attacker do with access to the adjacent network?
An attacker can send a single alarm ERROR frame to abort an established Application Relationship. They can also forge alarm notifications delivered to the application, choosing the alarm type, slot, subslot, USI, and payload.
How can I tell whether an exploitation attempt may have occurred?
Investigate unexpected Application Relationship aborts and alarm notifications whose type, slot, subslot, USI, or payload do not match expected device behavior. The available information does not provide a definitive detection method or logging indicator.