RT-Labs P-Net up to 1.0.3 PDPort handler buffer overflow

Summaryinfo

A vulnerability was found in RT-Labs P-Net up to 1.0.3. It has been rated as critical. Affected by this issue is some unknown functionality of the component PDPort handler. Performing a manipulation results in buffer overflow. This vulnerability is identified as CVE-2026-124758. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in RT-Labs P-Net up to 1.0.3. This affects an unknown function of the component PDPort handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length smaller than the header underflows and the handlers receive a data length of about 65530. The fixed-size reads of the I&M and PDPort handlers can then read past the end of the session buffer. The result of the write is discarded. The attacker must have an established Application Relationship or be able to send in the context of one, and requires ADJACENT network access.

It is possible to read the advisory at rt-labs.com. This vulnerability is uniquely identified as CVE-2026-124758 since 11/09/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.0.4 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• RT-Labs

Name

• P-Net

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion