P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade to P-Net 1.0.4 or later.
Workaround
No workaround given by the vendor.
References
History
Fri, 13 Nov 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active. | |
| Title | A DCP Set of the IP suite that is refused is still stored | |
| Weaknesses | CWE-696 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: rt-labs
Published:
Updated: 2026-11-13T13:24:02.359Z
Reserved: 2026-11-09T12:48:59.072Z
Link: CVE-2026-124761
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-13T14:17:50.613
Modified: 2026-11-13T14:17:50.710
Link: CVE-2026-124761
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses