CVE-2026-127123: Fragment with another data representation releases an Application Relationship
P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not told that the Application Relationship is gone, the cyclic data stops, and the resources of the Application Relationship are left referencing a cleared structure. Another host can then connect in its place. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can do this with one PDU.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P-Netto a version that resolves this vulnerability.Fixed in 1.0.4
Event History
Frequently Asked Questions
Which P-Net versions are affected?
P-Net versions before 1.0.4 are affected.
What does an attacker need to exploit this issue?
The attacker needs adjacent network access, must have observed the RPC connection's activity UUID, and can then use one PDU. The activity UUID is sent in clear in every RPC request.
What is the operational impact of a successful attack?
The existing RPC session's Application Relationship is released without the abort procedure, while the application is not notified. Cyclic data stops, resources can retain references to a cleared structure, and another host can connect in the displaced relationship's place.