CVE-2026-124758 · Infrastructure
NO FIX YET · SEE WHAT TO DO
P-Net, an industrial device communication stack, does not validate the length of certain IODWrite requests, so a crafted length underflows and handlers read past the session buffer. An attacker on the adjacent network with an established application relationship could read memory beyond the buffer.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems built on P-Net before 1.0.4 that accept IODWrite requests from industrial controllers on the adjacent network. Only devices that run the P-Net stack are exposed, and an attacker first needs an established Application Relationship or the ability to send within one.
Not affected if no-adjacent-network-access, p-net-1.0.4-or-later
Who cares industrial-control, p-net, profinet
Unknown from the sources.
1.0.4 or later, per the NVD description.P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length smaller than the header underflows and the handlers receive a data length of about 65530. The fixed-size reads of the I&M and PDPort handlers can then read past the end of the session buffer. The result of the write is discarded. The attacker must have an established Application Relationship or be able to send in the context of one, and requires ADJACENT network access.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.