7.1
HighCVSS 4.0 · from rt-labs
CVE-2026-111735
Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
P-Net · CWE-191 · CWE-191AffectedP-Net
FixUpdate to 1.0.3 or newer
PublishedOct 29, 15:42 · rt-labs
ScoredOct 29 · 7.1 · rt-labs
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker has to be on the same network. CVSS: adjacent network.
A successful attack can take the service down. CVSS impact.
Description
P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long enough. A crafted short frame makes the offset wrap around, so the function reads outside the receive buffer. This can cause a crash (denial of service) or disclose memory content.
From rt-labs
Affected and fixed versions
ProductAffectedFixed inP-Netbefore 1.0.31.0.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known