CVE-2026-115795Medium· 5.3▾ SunlitP-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is read past the end of the buffer. In addition, a DCP Set block with a length smaller than the two-byte block qualifier makes the length underflow, so the block is processed with a length of 65534 bytes. This can cause a crash (denial of service) or disclose a small amount of memory content. Requires ADJACENT network access.
P-Net < 1.0.3Upgrade to P-Net 1.0.3 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111735High· 7.1Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
CVE-2026-111734High· 7.1Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
CVE-2026-115793High· 8.7Resource exhaustion from RPC sessions kept for requests to unknown interface
CVE-2026-115794Low· 2.3Alarm data length not validated against received frame length
CVE-2026-112200High· 8.7Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
CVE-2026-111736High· 8.7NULL pointer dereference on implicit read of user specific record index