CVE-2026-127125: NULL pointer dereference when a response fragment is not acknowledged
P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent without being acknowledged, without checking that the session has an Application Relationship. A request for an existing Application Relationship that is sent on another activity than its Connect, and gets a fragmented response, is handled on a session without one. If the response is not acknowledged, a NULL pointer is dereferenced and the device crashes. A conformant IO-controller does not send such requests. The attacker must have observed the AR UUID of an established Application Relationship and requires ADJACENT network access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P-Netto a version that resolves this vulnerability.Fixed in 1.0.4
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
P-Net versions before 1.0.4 are affected when they have an established Application Relationship and are reachable by an attacker on an adjacent network. A conformant IO-controller does not send the request sequence that triggers the issue.
What does an attacker need to trigger the crash?
The attacker must observe the AR UUID of an established Application Relationship and have adjacent network access. They then need to send a request for that relationship on a different activity than its Connect, cause a fragmented response, and leave a resent response fragment unacknowledged.
What is the impact of successful exploitation?
The device crashes because P-Net dereferences a NULL pointer while handling the unacknowledged resent response fragment. The provided vector indicates an availability impact only.