Live › vulnerability › CVE-2026-111736
P-Net, a PROFINET device stack, dereferences a NULL pointer in pf_fspm_cm_read_ind() when it gets an implicit read request without a valid target AR UUID. A remote, unauthenticated attacker can send such a request to crash the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Only PROFINET devices built on P-Net before 1.0.3 that have registered a read callback are exposed, since the crash path requires that callback. Teams running industrial controllers or field devices with this stack should check their firmware versions. Devices on P-Net 1.0.3 or later, or without the callback, are not affected by this description.
No product ranges from the sources yet.
1.0.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specific record index, if the application has registered a read callback. A remote unauthenticated attacker can send such a request to crash the device (denial of service).
This page as .md · .json · in your agent: get_signal("CVE-2026-111736")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.