{"id":"CVE-2026-111736","kind":"vulnerability","aliases":["CVE-2026-111736"],"related":[],"title":"P-Net: a crafted read request crashes PROFINET devices (denial of service)","description":"P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specific record index, if the application has registered a read callback. A remote unauthenticated attacker can send such a request to crash the device (denial of service).","summary":"P-Net, a PROFINET device stack, dereferences a NULL pointer in pf_fspm_cm_read_ind() when it gets an implicit read request without a valid target AR UUID. A remote, unauthenticated attacker can send such a request to crash the device.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","industrial-controllers","p-net","package","profinet"],"not_affected_if":["no-read-callback","p-net-1.0.3-or-later"],"how_to_check":"- Check the P-Net version in the device firmware or build: unknown if the sources do not say how to read it\n- Confirm whether the application registers a read callback for user-specific record indexes: unknown if the sources do not say","fix":"- P-Net: move to `1.0.3` or later","status":"open","published_at":"2026-10-29T16:17:57+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:29:25+00:00","updated_at":"2026-10-29T16:29:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:29:25Z","model":"claude-haiku-5-5","output":{"fix":"- P-Net: move to `1.0.3` or later","reach":"network","title":"P-Net: a crafted read request crashes PROFINET devices (denial of service)","impact":"low","summary":"P-Net, a PROFINET device stack, dereferences a NULL pointer in pf_fspm_cm_read_ind() when it gets an implicit read request without a valid target AR UUID. A remote, unauthenticated attacker can send such a request to crash the device.","audience":"businesses","category":"package","nicknames":[],"who_cares":["p-net","profinet","industrial-controllers","embedded"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"remote attacker crashes the device, causing denial of service","analyst_note":"Confirm the affected-product list and whether the device firmware vendor has shipped the 1.0.3 update, using the NVD entry and the P-Net upstream release notes.","how_to_check":"- Check the P-Net version in the device firmware or build: unknown if the sources do not say how to read it\n- Confirm whether the application registers a read callback for user-specific record indexes: unknown if the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["p-net-1.0.3-or-later","no-read-callback"],"who_is_affected":"Only PROFINET devices built on P-Net before 1.0.3 that have registered a read callback are exposed, since the crash path requires that callback. Teams running industrial controllers or field devices with this stack should check their firmware versions. Devices on P-Net 1.0.3 or later, or without the callback, are not affected by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000714,"input_tokens":4145,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111736':16A,19A '-2026':15A,18A '1.0.3':76C 'applic':108C 'ar':57B,80C,98C 'attack':62B,117C 'callback':113C 'cm':43B,85C 'control':23B 'craft':5A 'crash':8A,69B,124C 'cve':14A,17A 'denial':11A,127C 'derefer':36B,77C 'devic':10A,34B,71B,126C 'embed':20B 'fspm':42B,84C 'get':48B 'handl':89C 'implicit':50B,91C 'ind':45B,87C 'index':105C 'industri':22B 'industrial-control':21B 'net':3A,26B,31B,74C 'null':38B,79C 'p':2A,25B,30B,73C 'p-net':1A,24B,29B,72C 'packag':27B 'pf':41B,83C 'pointer':39B,81C 'profinet':9A,28B,33B 'read':6A,44B,51B,86C,92C,112C 'record':104C 'regist':110C 'remot':60B,115C 'request':7A,52B,67B,93C,122C 'send':64B,119C 'servic':13A,129C 'specif':103C 'stack':35B 'target':56B,97C 'unauthent':61B,116C 'user':102C 'uuid':58B,99C 'valid':55B,96C 'without':53B,94C","nicknames":[],"mitigations":[],"who_affected":"Only PROFINET devices built on P-Net before 1.0.3 that have registered a read callback are exposed, since the crash path requires that callback. Teams running industrial controllers or field devices with this stack should check their firmware versions. Devices on P-Net 1.0.3 or later, or without the callback, are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111736","severity":null,"published_at":"2026-10-29T16:17:57+00:00","modified_at":"2026-10-29T16:17:57+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}