CVE-2026-124760

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-124760", "assignerOrgId": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee", "state": "PUBLISHED", "assignerShortName": "rt-labs", "dateReserved": "2026-11-09T12:48:59.072Z", "datePublished": "2026-11-13T13:23:45.251Z", "dateUpdated": "2026-11-13T13:23:45.251Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee", "shortName": "rt-labs", "dateUpdated": "2026-11-13T13:23:45.251Z"}, "title": "Alarm receiver stops delivering alarms after a malformed alarm notification", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}], "affected": [{"vendor": "RT-Labs", "product": "P-Net", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "P-Net before 1.0.4 sets the alarm receiver state to waiting for confirmation before the data of a received alarm notification is parsed. If the parsing fails the state is not restored, and later alarm notifications of the same priority are discarded without acknowledge until the Application Relationship is released. The Application Relationship and the cyclic data exchange keep working. The attacker must be able to send an alarm notification in the context of an established Application Relationship and requires ADJACENT network access.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>P-Net before 1.0.4 sets the alarm receiver state to waiting for confirmation before the data of a received alarm notification is parsed. If the parsing fails the state is not restored, and later alarm notifications of the same priority are discarded without acknowledge until the Application Relationship is released. The Application Relationship and the cyclic data exchange keep working. The attacker must be able to send an alarm notification in the context of an established Application Relationship and requires ADJACENT network access.</p>"}]}], "references": [{"url": "https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf", "name": "Cybersecurity advisory for P-Net"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to P-Net 1.0.4 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to P-Net 1.0.4 or later.</p>"}]}], "credits": [{"lang": "en", "value": "Aditya Gupta (Attify - attify.com)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "P-Net", "vendor": "RT-Labs", "versions": [{"lessThan": "1.0.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "P-Net before 1.0.4 sets the alarm receiver state to waiting for confirmation before the data of a received alarm notification is parsed. If the parsing fails the state is not restored, and later alarm notifications of the same priority are discarded without acknowledge until the Application Relationship is released. The Application Relationship and the cyclic data exchange keep working. The attacker must be able to send an alarm notification in the context of an established Application Relationship and requires ADJACENT network access."}], "id": "CVE-2026-124760", "lastModified": "2026-11-13T14:17:50.573", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee", "type": "Secondary"}]}, "published": "2026-11-13T14:17:50.480", "references": [{"source": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee", "url": "https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}], "sourceIdentifier": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "4b71179a-3b92-4a9d-b9fc-af8b8ed579ee", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "P-Net", "source": "cna", "vendor": "RT-Labs"}, "product": "p-net", "vendor": "rt-labs"}], "created": "2026-11-13T16:30:04.411466+00:00", "updated": "2026-11-13T16:30:04.411479+00:00", "vendors": ["rt-labs", "rt-labs$PRODUCT$p-net"]}