CVE-2026-13197
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In KUNBUS piControl version 2.6.2, a CWE-362 race condition vulnerability exists in the configuration and process-image management functionality. It allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects by sending concurrent crafted requests through the piControl character device, leading to kernel memory corruption and denial of service.
Risk Assessment
A local authenticated attacker can cause system crashes (denial of service) or potentially escalate privileges by corrupting kernel memory. This may disrupt industrial systems using piControl.
Recommendation
Upgrade KUNBUS piControl to a patched version if available. Restricting access to the piControl character device to trusted users can mitigate the risk.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests through the piControl character device.