{"id":"CVE-2026-124758","kind":"vulnerability","aliases":["CVE-2026-124758"],"related":[],"title":"P-Net: IODWrite length check lets industrial device read past buffer","description":"P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length smaller than the header underflows and the handlers receive a data length of about 65530. The fixed-size reads of the I&M and PDPort handlers can then read past the end of the session buffer. The result of the write is discarded. The attacker must have an established Application Relationship or be able to send in the context of one, and requires ADJACENT network access.","summary":"P-Net, an industrial device communication stack, does not validate the length of certain IODWrite requests, so a crafted length underflows and handlers read past the session buffer. An attacker on the adjacent network with an established application relationship could read memory beyond the buffer.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["industrial-control","infrastructure","p-net","profinet"],"not_affected_if":["no-adjacent-network-access","p-net-1.0.4-or-later"],"how_to_check":null,"fix":"- Move to P-Net `1.0.4` or later, per the NVD description.","status":"open","published_at":"2026-11-13T14:17:50+00:00","first_seen_at":"2026-11-13T15:19:48+00:00","triaged_at":"2026-11-13T15:21:39+00:00","updated_at":"2026-11-13T15:21:39+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T15:21:39Z","model":"claude-haiku-5-5","output":{"fix":"- Move to P-Net `1.0.4` or later, per the NVD description.","reach":"network","title":"P-Net: IODWrite length check lets industrial device read past buffer","impact":"low","summary":"P-Net, an industrial device communication stack, does not validate the length of certain IODWrite requests, so a crafted length underflows and handlers read past the session buffer. An attacker on the adjacent network with an established application relationship could read memory beyond the buffer.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["p-net","industrial-control","profinet"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"memory past the session buffer is read by an attacker","analyst_note":"Confirm the P-Net version in deployed devices and whether a vendor advisory states a check method; NVD gives only the description.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["p-net-1.0.4-or-later","no-adjacent-network-access"],"who_is_affected":"Systems built on P-Net before 1.0.4 that accept IODWrite requests from industrial controllers on the adjacent network. Only devices that run the P-Net stack are exposed, and an attacker first needs an established Application Relationship or the ability to send within one.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000712,"input_tokens":4630,"output_tokens":497,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-124758':15A,18A '-2026':14A,17A '1.0.4':77C '32':105C '65530':139C 'abl':179C 'access':191C 'adjac':60B,189C 'applic':65B,175C 'attack':57B,170C 'beyond':70B 'bit':106C 'block':102C 'buffer':12A,55B,72B,161C 'certain':41B 'check':6A,80C 'communic':33B 'context':184C 'control':21B 'could':67B 'craft':46B 'cve':13A,16A 'data':83C,135C 'devic':9A,32B 'discard':168C 'end':157C 'establish':64B,174C 'fix':142C 'fixed-s':141C 'handler':50B,121C,132C,151C 'header':103C,112C,128C 'index':95C 'industri':8A,20B,31B 'industrial-control':19B 'infrastructur':22B 'iodwrit':4A,42B,87C 'length':5A,39B,47B,84C,107C,124C,136C 'let':7A 'm':148C 'memori':69B 'must':171C 'net':3A,25B,29B,75C 'network':61B,190C 'non':92C 'non-us':91C 'one':186C 'p':2A,24B,28B,74C 'p-net':1A,23B,27B,73C 'pass':117C 'past':11A,52B,155C 'pdport':150C 'profinet':26B 'read':10A,51B,68B,144C,154C 'receiv':133C 'record':82C,94C,101C,120C 'reduc':109C 'relationship':66B,176C 'request':43B,88C 'requir':188C 'result':163C 'send':181C 'session':54B,160C 'size':98C,113C,143C 'smaller':125C 'stack':34B 'underflow':48B,129C 'user':93C 'valid':37B 'write':166C","nicknames":[],"mitigations":[],"who_affected":"Systems built on P-Net before 1.0.4 that accept IODWrite requests from industrial controllers on the adjacent network. Only devices that run the P-Net stack are exposed, and an attacker first needs an established Application Relationship or the ability to send within one.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["industrialcontrol","infrastructure","low","pnet","profinet"],"campaign_type":null,"search_a":"'-124758':15A,18A '-2026':14A,17A 'buffer':12A 'check':6A 'cve':13A,16A 'devic':9A 'industri':8A 'iodwrit':4A 'length':5A 'let':7A 'net':3A 'p':2A 'p-net':1A 'past':11A 'read':10A","search_b":"'adjac':60B 'applic':65B 'attack':57B 'beyond':70B 'buffer':55B,72B 'certain':41B 'communic':33B 'control':21B 'could':67B 'craft':46B 'devic':32B 'establish':64B 'handler':50B 'industri':20B,31B 'industrial-control':19B 'infrastructur':22B 'iodwrit':42B 'length':39B,47B 'memori':69B 'net':25B,29B 'network':61B 'p':24B,28B 'p-net':23B,27B 'past':52B 'profinet':26B 'read':51B,68B 'relationship':66B 'request':43B 'session':54B 'stack':34B 'underflow':48B 'valid':37B","search_c":"'1.0.4':77C '32':105C '65530':139C 'abl':179C 'access':191C 'adjac':189C 'applic':175C 'attack':170C 'bit':106C 'block':102C 'buffer':161C 'check':80C 'context':184C 'data':83C,135C 'discard':168C 'end':157C 'establish':174C 'fix':142C 'fixed-s':141C 'handler':121C,132C,151C 'header':103C,112C,128C 'index':95C 'iodwrit':87C 'length':84C,107C,124C,136C 'm':148C 'must':171C 'net':75C 'network':190C 'non':92C 'non-us':91C 'one':186C 'p':74C 'p-net':73C 'pass':117C 'past':155C 'pdport':150C 'read':144C,154C 'receiv':133C 'record':82C,94C,101C,120C 'reduc':109C 'relationship':176C 'request':88C 'requir':188C 'result':163C 'send':181C 'session':160C 'size':98C,113C,143C 'smaller':125C 'underflow':129C 'user':93C 'write':166C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124758","severity":null,"published_at":"2026-11-13T14:17:50+00:00","modified_at":"2026-11-13T14:17:50+00:00","first_seen_at":"2026-11-13T15:19:48+00:00","fetched_at":"2026-11-13T15:19:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}