CVE-2026-124759

Description

P-Net before 1.0.4 routes a received RTA alarm frame to an Application Relationship using only the destination alarm reference in the frame, without checking the source of the frame. A host with ADJACENT network access can abort an established Application Relationship with a single alarm ERROR frame, or deliver forged alarm notifications with chosen type, slot, subslot, USI and payload to the application.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 7.1CVSS 4.0, Highfrom the CNA (rt-labs)CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

What to do

• Upgrade to P-Net 1.0.4 or later, which ignores alarm frames that do not come from the IO-controller of the Application Relationship. It reduces the risk but does not remove it, see Remaining Risk.CNA solution statement
• Isolate the network of the device from untrusted hosts, for example by a firewall or a separate network,. The remaining risk is that a host on the network that knows the MAC address of the IO-controller and the alarm references can still send forged alarm frames.CNA workaround statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 13 Nov 2026 Published

Weakness

• CWE-346

References

• Cybersecurity advisory for P-Net