Live › vulnerability › CVE-2026-111730
P-Net, an embedded PROFINET device library, does not check a length field in a CheckPeers block, so a crafted block writes up to 15 bytes past a 241-byte buffer. An attacker on the adjacent network can crash the device or potentially run code on it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Systems built on P-Net before 1.0.3 that accept PROFINET connections, typically industrial controllers and devices. Exposure requires an attacker to establish a session from the adjacent network, so devices isolated from that segment are less reachable. Teams that do not embed P-Net can skip it.
No product ranges from the sources yet.
1.0.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution.
Requires establishment of session that needs ADJACENT network access.
This page as .md · .json · in your agent: get_signal("CVE-2026-111730")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.