8.7
HighCVSS 4.0 · from rt-labs
CVE-2026-111736
NULL pointer dereference on implicit read of user specific record index
P-Net · NULL pointer dereference · CWE-476AffectedP-Net
FixUpdate to 1.0.3 or newer
PublishedOct 29, 15:43 · rt-labs
ScoredOct 29 · 8.7 · rt-labs
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can take the service down. CVSS impact.
Description
P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specific record index, if the application has registered a read callback. A remote unauthenticated attacker can send such a request to crash the device (denial of service).
From rt-labs
Affected and fixed versions
ProductAffectedFixed inP-Netbefore 1.0.31.0.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known