{"id":"CVE-2026-124759","kind":"vulnerability","aliases":["CVE-2026-124759"],"related":[],"title":"P-Net: forged industrial alarm frames can abort controller connections","description":"P-Net before 1.0.4 routes a received RTA alarm frame to an Application Relationship using only the destination alarm reference in the frame, without checking the source of the frame. A host with ADJACENT network access can abort an established Application Relationship with a single alarm ERROR frame, or deliver forged alarm notifications with chosen type, slot, subslot, USI and payload to the application.","summary":"P-Net is an embedded PROFINET device stack used in industrial equipment. A host on the same network segment can send a forged alarm frame to end an established Application Relationship or inject fake alarm notifications into the application.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"P-Net","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["embedded","industrial-control","infrastructure","p-net","profinet"],"not_affected_if":["isolated-network","no-profinet-devices","version-1.0.4-or-later"],"how_to_check":"- Check whether the device firmware or application includes P-Net, and its version, against `1.0.4` or later.\n- Confirm whether the device is reachable from an adjacent network segment that untrusted hosts can join.","fix":"- P-Net: move to `1.0.4` or later (per the NVD description: fixed before 1.0.4).","status":"open","published_at":"2026-11-13T14:17:50+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","triaged_at":"2026-11-13T15:21:19+00:00","updated_at":"2026-11-13T15:21:19+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T15:21:19Z","model":"claude-haiku-5-5","output":{"fix":"- P-Net: move to `1.0.4` or later (per the NVD description: fixed before 1.0.4).","reach":"network","title":"P-Net: forged industrial alarm frames can abort controller connections","impact":"high","summary":"P-Net is an embedded PROFINET device stack used in industrial equipment. A host on the same network segment can send a forged alarm frame to end an established Application Relationship or inject fake alarm notifications into the application.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["profinet","p-net","industrial-control","embedded"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker aborts industrial connections and injects forged alarm data","analyst_note":"Find the vendor advisory and the list of affected PROFINET products, and confirm the fixed version at https://nvd.nist.gov/vuln/detail/CVE-2026-124759.","how_to_check":"- Check whether the device firmware or application includes P-Net, and its version, against `1.0.4` or later.\n- Confirm whether the device is reachable from an adjacent network segment that untrusted hosts can join.","plain_action":"","product_name":"P-Net","needs_analyst":true,"not_affected_if":["no-profinet-devices","isolated-network","version-1.0.4-or-later"],"who_is_affected":"Industrial devices and controllers that embed P-Net for PROFINET communication, where an attacker on the same local network can reach the device. Systems with no PROFINET device on an untrusted network segment are less exposed. unknown whether the sources list specific vendor products.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000765,"input_tokens":4582,"output_tokens":613,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124759':14A,17A '-2026':13A,16A '1.0.4':74C 'abort':9A,108C 'access':106C 'adjac':104C 'alarm':6A,54B,65B,79C,89C,116C,122C 'applic':60B,69B,83C,111C,134C 'check':95C 'chosen':125C 'connect':11A 'control':10A,24B 'cve':12A,15A 'deliv':120C 'destin':88C 'devic':37B 'embed':21B,35B 'end':57B 'equip':42B 'error':117C 'establish':59B,110C 'fake':64B 'forg':4A,53B,121C 'frame':7A,55B,80C,93C,100C,118C 'host':44B,102C 'industri':5A,23B,41B 'industrial-control':22B 'infrastructur':25B 'inject':63B 'net':3A,20A,28B,32B,72C 'network':48B,105C 'notif':66B,123C 'p':2A,19A,27B,31B,71C 'p-net':1A,18A,26B,30B,70C 'payload':131C 'profinet':29B,36B 'receiv':77C 'refer':90C 'relationship':61B,84C,112C 'rout':75C 'rta':78C 'segment':49B 'send':51B 'singl':115C 'slot':127C 'sourc':97C 'stack':38B 'subslot':128C 'type':126C 'use':39B,85C 'usi':129C 'without':94C","nicknames":[],"mitigations":[],"who_affected":"Industrial devices and controllers that embed P-Net for PROFINET communication, where an attacker on the same local network can reach the device. Systems with no PROFINET device on an untrusted network segment are less exposed. unknown whether the sources list specific vendor products.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["pnet"],"ptokens":["net"],"labels":["embedded","high","industrialcontrol","infrastructure","pnet","profinet","vendor"],"campaign_type":null,"search_a":"'-124759':14A,17A '-2026':13A,16A 'abort':9A 'alarm':6A 'connect':11A 'control':10A 'cve':12A,15A 'forg':4A 'frame':7A 'industri':5A 'net':3A,20A 'p':2A,19A 'p-net':1A,18A","search_b":"'alarm':54B,65B 'applic':60B,69B 'control':24B 'devic':37B 'embed':21B,35B 'end':57B 'equip':42B 'establish':59B 'fake':64B 'forg':53B 'frame':55B 'host':44B 'industri':23B,41B 'industrial-control':22B 'infrastructur':25B 'inject':63B 'net':28B,32B 'network':48B 'notif':66B 'p':27B,31B 'p-net':26B,30B 'profinet':29B,36B 'relationship':61B 'segment':49B 'send':51B 'stack':38B 'use':39B","search_c":"'1.0.4':74C 'abort':108C 'access':106C 'adjac':104C 'alarm':79C,89C,116C,122C 'applic':83C,111C,134C 'check':95C 'chosen':125C 'deliv':120C 'destin':88C 'error':117C 'establish':110C 'forg':121C 'frame':80C,93C,100C,118C 'host':102C 'net':72C 'network':105C 'notif':123C 'p':71C 'p-net':70C 'payload':131C 'receiv':77C 'refer':90C 'relationship':84C,112C 'rout':75C 'rta':78C 'singl':115C 'slot':127C 'sourc':97C 'subslot':128C 'type':126C 'use':85C 'usi':129C 'without':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124759","severity":null,"published_at":"2026-11-13T14:17:50+00:00","modified_at":"2026-11-13T14:17:50+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","fetched_at":"2026-11-13T15:19:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}