{"affected":[{"defaultStatus":"unaffected","product":"P-Net","source":"CNA: rt-labs","vendor":"RT-Labs","versions":[{"lessThan":"1.0.4","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-127125","cwes":["CWE-476"],"description":"P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent without being acknowledged, without checking that the session has an Application Relationship. A request for an existing Application Relationship that is sent on another activity than its Connect, and gets a fragmented response, is handled on a session without one. If the response is not acknowledged, a NULL pointer is dereferenced and the device crashes. A conformant IO-controller does not send such requests. The attacker must have observed the AR UUID of an established Application Relationship and requires ADJACENT network access.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6,"severity":"medium","source":"CNA: rt-labs","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":6,"severity":"medium","source":"NVD: 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794600318831,"publishedAt":1794576353422,"references":[{"source":"CNA: rt-labs","tags":[],"url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"},{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","tags":[],"url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}],"remediation":[{"kind":"fix","source":"CNA: rt-labs","text":"Upgrade to P-Net 1.0.4 or later."}],"revision":"366e6c13b3f1d0493a5bb93da1d61e7f15a77c2e8d9a87606416975d16c39097","sources":[{"modifiedAt":1794600318831,"name":"CNA: rt-labs","retrievedAt":1794604199948,"url":"https://www.cve.org/CVERecord?id=CVE-2026-127125"},{"modifiedAt":1794579475190,"name":"NVD","retrievedAt":1794594073371,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127125"}],"ssvc":{"assessedAt":1794599656410,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"NULL pointer dereference when a response fragment is not acknowledged","updatedAt":1794604199948}