148 matches found
CVE-2026-112200
Versions of P-Net before 1.0.3 are vulnerable to a resource exhaustion issue. When an RPC request is rejected due to incorrect data endianness, the software fails to release the Application Relationship (AR) and the RPC session . Repeated requests can exhaust available sessions, causing the devic...
EUVD-2026-113009
P-Net before 1.0.3 contains an integer underflow in pfcpmcdataind. When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic, without checking that the frame is long...
CVE-2026-111735
The software P-Net versions prior to 1.0.3 is vulnerable to an integer underflow in the pf_cpm_c_data_ind() function. When the consumer is in the FRUN or RUN state, the system handles received cyclic data frames by computing the APDU status offset as the frame length minus 4 using 16-bit arithmet...
EUVD-2026-113008
P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pfethrecv before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN tags, makes the function read past the end...
CVE-2026-111734
P-Net versions prior to 1.0.3 are vulnerable to an out-of-bounds read within the pf_eth_recv() function. The software fails to validate the length of received Ethernet frames before processing the EtherType, VLAN tags, and PROFINET FrameID. Because the VLAN tag loop lacks an upper bound, processi...
EUVD-2026-113007
P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot. A remote unauthenticated attacker can send...
CVE-2026-111733
The P-Net software (versions prior to 1.0.3 ) is vulnerable to a NULL pointer dereference when processing implicit read requests. This occurs when a request lacks a valid target AR UUID for a record index requiring an AR (specifically indices 0xE000-0xEFFF and expected slot/subslot identification...
EUVD-2026-113006
P-Net before 1.0.3, when built with PNETOPTIONARVENDORBLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block...
CVE-2026-111732
Versions of P-Net prior to 1.0.3 are vulnerable to an out-of-bounds write when built with the PNET_OPTION_AR_VENDOR_BLOCKS option enabled. The software fails to validate a data length field from an ARVendorBlock request against the fixed-size buffer capacity, using the provided length as the byte...
EUVD-2026-113005
P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 whole module. The loop over the ports never advanced to the next port, so the request never completes and the device stops responding. A remote unauthenticated attacker can use th...
CVE-2026-111731
The software P-Net (versions before 1.0.3 ) is vulnerable to a denial of service (DoS) due to an infinite loop triggered during the processing of a read request. Specifically, when handling a PDPortDataCheck record with subslot 0 (whole module), the loop over the ports fails to advance to the nex...
EUVD-2026-113004
P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in getcheckpeer. The received length up to 255 was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end o...
CVE-2026-111730
P-Net versions prior to 1.0.3 are vulnerable to an out-of-bounds write within the get_check_peer() function. The root cause is a failure to validate the LengthPeerStationName field of a CheckPeers block , where a received length of up to 255 is used to copy data into a fixed 241-byte buffer . Thi...
EUVD-2025-13677
Malicious code in bioql PyPI...
EUVD-2025-13676
Malicious code in bioql PyPI...
EUVD-2025-13675
Malicious code in bioql PyPI...
EUVD-2025-13674
Malicious code in bioql PyPI...
EUVD-2025-13673
Malicious code in bioql PyPI...