CVE-2026-124760: Alarm receiver stops delivering alarms after a malformed alarm notification
P-Net before 1.0.4 sets the alarm receiver state to waiting for confirmation before the data of a received alarm notification is parsed. If the parsing fails the state is not restored, and later alarm notifications of the same priority are discarded without acknowledge until the Application Relationship is released. The Application Relationship and the cyclic data exchange keep working. The attacker must be able to send an alarm notification in the context of an established Application Relationship and requires ADJACENT network access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.4
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
P-Net versions before 1.0.4 are affected when they receive alarm notifications over an established Application Relationship. The attacker needs adjacent-network access and the ability to send an alarm notification within that established relationship.
What is the operational impact after exploitation?
Later alarm notifications with the same priority are discarded without acknowledgment until the Application Relationship is released. Cyclic data exchange and the Application Relationship itself continue operating.
How can the affected alarm delivery be restored?
Release the affected Application Relationship. This restores processing because the condition persists only until that relationship is released.