CVE-2026-112200High· 8.7▾ TwilightP-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requ…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Last analysed / modified upstream
P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
P-Net < 1.0.3Upgrade to P-Net 1.0.3 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115793High· 8.7Resource exhaustion from RPC sessions kept for requests to unknown interface
CVE-2026-115794Low· 2.3Alarm data length not validated against received frame length
CVE-2026-115795Medium· 5.3Out-of-bounds read of DCP block header in DCP Set and Identify request parsing
CVE-2026-111735High· 7.1Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
CVE-2026-111736High· 8.7NULL pointer dereference on implicit read of user specific record index
CVE-2026-111733High· 8.7NULL pointer dereference on implicit read of AR specific record index