CVE-2026-111731High· 8.7▾ TwilightP-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the request never completes and the device …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Last analysed / modified upstream
P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the request never completes and the device stops responding. A remote unauthenticated attacker can use this to cause a denial of service.
P-Net < 1.0.3Upgrade to P-Net 1.0.3 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115793High· 8.7Resource exhaustion from RPC sessions kept for requests to unknown interface
CVE-2026-115794Low· 2.3Alarm data length not validated against received frame length
CVE-2026-115795Medium· 5.3Out-of-bounds read of DCP block header in DCP Set and Identify request parsing
CVE-2026-111735High· 7.1Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
CVE-2026-112200High· 8.7Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
CVE-2026-111736High· 8.7NULL pointer dereference on implicit read of user specific record index