{"id":"CVE-2026-111730","kind":"vulnerability","aliases":["CVE-2026-111730"],"related":[],"title":"P-Net: unchecked length lets a crafted network packet overflow memory","description":"P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution.\n\n\n\nRequires establishment of session that needs ADJACENT network access.","summary":"P-Net, an embedded PROFINET device library, does not check a length field in a CheckPeers block, so a crafted block writes up to 15 bytes past a 241-byte buffer. An attacker on the adjacent network can crash the device or potentially run code on it.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","industrial-control","p-net","package","profinet"],"not_affected_if":["isolated-network","not-embedded-p-net","version-1.0.3-or-later"],"how_to_check":"- Check whether the device firmware or application links P-Net, and which version: unknown if the sources do not say how it is packaged.\n- Confirm the installed P-Net version: unknown if the sources do not say where the version is recorded.","fix":"- P-Net: move to `1.0.3` or later\n- Fix status and vendor advisories: unknown","status":"open","published_at":"2026-10-29T16:17:57+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:29:53+00:00","updated_at":"2026-10-29T16:29:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- P-Net: move to `1.0.3` or later\n- Fix status and vendor advisories: unknown","reach":"network","title":"P-Net: unchecked length lets a crafted network packet overflow memory","impact":"high","summary":"P-Net, an embedded PROFINET device library, does not check a length field in a CheckPeers block, so a crafted block writes up to 15 bytes past a 241-byte buffer. An attacker on the adjacent network can crash the device or potentially run code on it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["p-net","profinet","embedded","industrial-control"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Device crashes, or attacker may run code on it","analyst_note":"Confirm from the NVD entry or the P-Net repository advisory whether session establishment needs credentials and whether a default configuration is affected.","how_to_check":"- Check whether the device firmware or application links P-Net, and which version: unknown if the sources do not say how it is packaged.\n- Confirm the installed P-Net version: unknown if the sources do not say where the version is recorded.","plain_action":"","needs_analyst":true,"not_affected_if":["not-embedded-p-net","isolated-network","version-1.0.3-or-later"],"who_is_affected":"Systems built on P-Net before 1.0.3 that accept PROFINET connections, typically industrial controllers and devices. Exposure requires an attacker to establish a session from the adjacent network, so devices isolated from that segment are less reachable. Teams that do not embed P-Net can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4191,"output_tokens":599,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111730':15A,18A '-2026':14A,17A '1.0.3':78C '15':53B,126C '241':57B,106C '255':98C 'access':156C 'adjac':64B,154C 'arbitrari':145C 'attack':61B 'block':45B,49B,88C,122C 'buffer':59B,111C,133C 'byte':54B,58B,107C,118C,127C 'check':38B,91C 'checkpeer':44B,87C 'code':73B,146C 'control':22B 'copi':102C 'craft':8A,48B,121C 'crash':67B,139C 'cve':13A,16A 'data':103C 'denial':140C 'devic':34B,69B 'embed':19B,32B 'end':130C 'establish':149C 'execut':147C 'field':41B,84C 'get':90C 'industri':21B 'industrial-control':20B 'lead':136C 'length':5A,40B,95C 'lengthpeerstationnam':83C 'let':6A 'librari':35B 'memori':12A 'name':110C 'need':153C 'net':3A,25B,30B,76C 'network':9A,65B,155C 'nul':117C 'overflow':11A 'p':2A,24B,29B,75C 'p-net':1A,23B,28B,74C 'packag':26B 'packet':10A 'past':55B,128C 'peer':92C,108C 'place':114C 'potenti':71B,144C 'profinet':27B,33B 'receiv':94C 'requir':148C 'run':72B 'servic':142C 'session':151C 'station':109C 'termin':116C 'uncheck':4A 'use':100C 'valid':81C 'write':50B,123C","nicknames":[],"mitigations":[],"who_affected":"Systems built on P-Net before 1.0.3 that accept PROFINET connections, typically industrial controllers and devices. Exposure requires an attacker to establish a session from the adjacent network, so devices isolated from that segment are less reachable. Teams that do not embed P-Net can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111730","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111730","severity":null,"published_at":"2026-10-29T16:17:57+00:00","modified_at":"2026-10-29T16:17:57+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}