CVE-2026-127125

P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent without being acknowledged, without checking that the session has an Application Relationship. A request for an existing Application Relationship that is sent on another activity than its Connect, and gets a fragmented response, is handled on a session without one. If the response is not acknowledged, a NULL pointer is dereferenced and the device crashes. A conformant IO-controller does not send such requests. The attacker must have observed the AR UUID of an established Application Relationship and requires ADJACENT network access.

• CWE-476

• https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-127119Unverified ownership of the default cluster log location in …5.3
• CVE-2026-127120A vulnerability was found in Governikus AusweisApp Mobile up…4.3
• CVE-2026-127121SOGo before 5.12.13 contains an improper cryptographic signa…6.5
• CVE-2026-127122P-Net before 1.0.4 does not check the number of MCR request …7.2
• CVE-2026-127123P-Net before 1.0.4 releases the Application Relationship of …6
• CVE-2026-127124P-Net before 1.0.4 keeps the RPC session that is allocated f…7.1
• CVE-2026-12713The WPCargo Track & Trace WordPress plugin before 8.0.4 does…9.1
• CVE-2026-127131SOGo before 5.12.13 contains a missing rate limiting vulnera…7.4
• CVE-2026-127135SOGo before 5.12.13 contains a Sieve script injection vulner…4.3
• CVE-2026-127141SOGo before 5.12.13 contains a denial of service vulnerabili…6.5
• CVE-2026-127145SOGo before 5.12.13 contains a server-side request forgery v…4.3
• CVE-2026-12715Missing Authorization in Google Cloud Firebase Studio versio…8.5