---
id: "CVE-2026-111730"
kind: "vulnerability"
aliases: ["CVE-2026-111730"]
title: "P-Net: unchecked length lets a crafted network packet overflow memory"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded", "industrial-control", "p-net", "package", "profinet"]
not_affected_if: ["isolated-network", "not-embedded-p-net", "version-1.0.3-or-later"]
published_at: "2026-10-29T16:17:57+00:00"
first_seen_at: "2026-10-29T16:25:56+00:00"
updated_at: "2026-10-29T16:29:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111730", "first_seen_at": "2026-10-29T16:25:56+00:00"}]
---

# P-Net: unchecked length lets a crafted network packet overflow memory

P-Net, an embedded PROFINET device library, does not check a length field in a CheckPeers block, so a crafted block writes up to 15 bytes past a 241-byte buffer. An attacker on the adjacent network can crash the device or potentially run code on it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the device firmware or application links P-Net, and which version: unknown if the sources do not say how it is packaged.
- Confirm the installed P-Net version: unknown if the sources do not say where the version is recorded.

## Fix

- P-Net: move to `1.0.3` or later
- Fix status and vendor advisories: unknown

## Timeline

- 2026-10-29T16:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111730

## From the sources

P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution.



Requires establishment of session that needs ADJACENT network access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_