CVE-2026-124762: RPC reject, fault and cancel PDUs abort an Application Relationship
P-Net before 1.0.4 finds the RPC session of a received PDU by its activity UUID only, and a reject, fault or cancel PDU for the session aborts the Application Relationship, without checking that the PDU is the answer to a call of the device or where it comes from. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can abort the Application Relationship with one PDU. It also allocates a session for an unknown activity UUID and changes the address stored for an existing session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.4
Event History
Frequently Asked Questions
Which systems are realistically exposed?
P-Net versions before 1.0.4 are exposed when an attacker has adjacent network access and can observe the activity UUID for an RPC connection. The UUID is sent in clear in every RPC request.
What does an attacker need to disrupt an Application Relationship?
The attacker needs to observe the target connection's activity UUID and send a single reject, fault, or cancel PDU for that session. The PDU is not validated as an answer to a device call or by its source.
Are unknown activity UUIDs handled safely?
No. The affected implementation allocates a session for an unknown activity UUID and can change the address stored for an existing session.