CVE-2026-115793：P‑Net RPC 連線耗盡導致服務拒絕
CVE-2026-115793 - Resource exhaustion from RPC sessions kept for requests to unknown interface
CVE-2026-115793 讓 P‑Net 1.0.3 以下版本因 RPC 連線未釋放而被耗盡，遠端未授權攻擊者可造成服務拒絕。
- 受影響產品：Rt‑labs P‑Net 1.0.3 之前版本
- 危害程度：CVSS 4.0 HIGH，能使裝置在連線耗盡後停止回應 RPC 請求
- 緩解措施：升級至 1.0.3 或以上，或重啟裝置釋放連線。
P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
Impact
Affected Products
The following products are affected by CVE-2026-115793
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | Rt-labs | p-net |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | HIGH | 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee |
Update P-Net to version 1.0.3 or later to fix RPC session exhaustion leading to denial of service.
- Update P-Net to version 1.0.3 or later.
- Restart the device if sessions are exhausted.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-115793 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.