CVE-2026-112200：不正確端序 RPC 請求導致 AR 與 RPC 會話未釋放，造成資源耗盡
CVE-2026-112200 - Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
summary_zh: **Rt-labs 的 P‑Net 1.0.3 之前版本因 RPC 請求端序錯誤未釋放 AR 與 RPC 會話，遠端未授權攻擊者可造成 DoS。
P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
Impact
Affected Products
The following products are affected by CVE-2026-112200
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | Rt-labs | p-net |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | HIGH | 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee |
Update P-Net to 1.0.3 or later to fix the RPC session exhaustion vulnerability.
- Update P-Net to version 1.0.3 or later.
- Restart the device if sessions are exhausted.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-112200 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.