---
id: "CVE-2026-124758"
page: "https://infrastack.ai/live/CVE-2026-124758"
kind: "vulnerability"
aliases: ["CVE-2026-124758"]
title: "P-Net: IODWrite length check lets industrial device read past buffer"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["industrial-control", "infrastructure", "p-net", "profinet"]
not_affected_if: ["no-adjacent-network-access", "p-net-1.0.4-or-later"]
published_at: "2026-11-13T14:17:50+00:00"
first_seen_at: "2026-11-13T15:19:48+00:00"
updated_at: "2026-11-13T15:21:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124758", "first_seen_at": "2026-11-13T15:19:48+00:00"}]
exploit_sources: []
---

# P-Net: IODWrite length check lets industrial device read past buffer

Link for people: https://infrastack.ai/live/CVE-2026-124758 (this .md is for agents)

P-Net, an industrial device communication stack, does not validate the length of certain IODWrite requests, so a crafted length underflows and handlers read past the session buffer. An attacker on the adjacent network with an established application relationship could read memory beyond the buffer.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Move to P-Net `1.0.4` or later, per the NVD description.

## Timeline

- 2026-11-13T15:19:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124758

## From the sources

P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length smaller than the header underflows and the handlers receive a data length of about 65530. The fixed-size reads of the I&M and PDPort handlers can then read past the end of the session buffer. The result of the write is discarded. The attacker must have an established Application Relationship or be able to send in the context of one, and requires ADJACENT network access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_