KUNBUS piControl 2.6.2 Configuration And Process-Image Management race condition

Summaryinfo

A vulnerability was found in KUNBUS piControl 2.6.2. It has been classified as very critical. This issue affects some unknown processing of the component Configuration And Process-Image Management. This manipulation causes race condition. This vulnerability is handled as CVE-2026-13197. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability was found in KUNBUS piControl 2.6.2. It has been declared as very critical. Affected by this vulnerability is an unknown code block of the component Configuration And Process-Image Management. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests through the piControl character device.

It is possible to read the advisory at nozominetworks.com. This vulnerability is known as CVE-2026-13197 since 06/24/2026. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/14/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• KUNBUS

Name

• piControl

Version

• 2.6.2

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion