CVE-2026-124761 · Package
NO FIX YET · SEE WHAT TO DO
P-Net, an industrial Profinet device stack, copies a DCP Set IP address change into its saved configuration before checking the device state, so a refused request is still persisted. After a restart the device can run on the refused address, which can break controller communication or let a nearby host take over its address.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Industrial devices that embed the P-Net stack and accept Profinet DCP Set requests from the local network while an Application Relationship is active. Devices with no Profinet DCP exposure on the local segment, or without an active Application Relationship, are less exposed.
Not affected if no-profinet-dcp-exposure, p-net-1.0.4-or-later
Who cares embedded, industrial-devices, p-net, profinet
1.0.4 or later (per the advisory's 'before 1.0.4' range).P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.