{"id":"CVE-2026-124761","kind":"vulnerability","aliases":["CVE-2026-124761"],"related":[],"title":"P-Net: refused DCP Set request still saves new IP address","description":"P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active.","summary":"P-Net, an industrial Profinet device stack, copies a DCP Set IP address change into its saved configuration before checking the device state, so a refused request is still persisted. After a restart the device can run on the refused address, which can break controller communication or let a nearby host take over its address.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","industrial-devices","p-net","package","profinet"],"not_affected_if":["no-profinet-dcp-exposure","p-net-1.0.4-or-later"],"how_to_check":"- Check the P-Net version the device firmware embeds; unknown if the sources do not say which products ship it.\n- Look for an active Application Relationship on the device while a DCP Set request is possible from the local network.","fix":"- P-Net: move to `1.0.4` or later (per the advisory's 'before 1.0.4' range).","status":"open","published_at":"2026-11-13T14:17:50+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","triaged_at":"2026-11-13T15:21:19+00:00","updated_at":"2026-11-13T15:21:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:21:19Z","model":"claude-haiku-5-5","output":{"fix":"- P-Net: move to `1.0.4` or later (per the advisory's 'before 1.0.4' range).","reach":"network","title":"P-Net: refused DCP Set request still saves new IP address","impact":"medium","summary":"P-Net, an industrial Profinet device stack, copies a DCP Set IP address change into its saved configuration before checking the device state, so a refused request is still persisted. After a restart the device can run on the refused address, which can break controller communication or let a nearby host take over its address.","audience":"businesses","category":"package","nicknames":[],"who_cares":["p-net","profinet","industrial-devices","embedded"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"device restarts on a refused IP address, dropping controller communication","analyst_note":"Check which vendor products embed P-Net and whether a vendor advisory names affected firmware; sources given only cover NVD.","how_to_check":"- Check the P-Net version the device firmware embeds; unknown if the sources do not say which products ship it.\n- Look for an active Application Relationship on the device while a DCP Set request is possible from the local network.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["p-net-1.0.4-or-later","no-profinet-dcp-exposure"],"who_is_affected":"Industrial devices that embed the P-Net stack and accept Profinet DCP Set requests from the local network while an Application Relationship is active. Devices with no Profinet DCP exposure on the local segment, or without an active Application Relationship, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4602,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124761':15A,18A '-2026':14A,17A '1.0.4':88C 'access':166C 'activ':131C,175C 'address':12A,41B,69B,83B,149C,160C 'adjac':164C 'answer':153C 'applic':128C,172C 'break':72B 'chang':42B 'check':48B,118C 'communic':74B 'configur':46B,106C,133C 'control':73B,155C 'copi':36B,89C 'current':100C 'cve':13A,16A 'dcp':5A,38B,95C 'devic':22B,34B,50B,63B,116C,145C 'embed':19B 'exampl':125C 'host':79B,162C 'industri':21B,32B 'industrial-devic':20B 'ip':11A,40B,91C 'let':76B 'may':151C,157C 'nearbi':78B 'net':3A,25B,30B,86C 'network':165C 'new':10A 'non':104C 'non-volatil':103C 'p':2A,24B,29B,85C 'p-net':1A,23B,28B,84C 'packag':26B 'persist':58B 'profinet':27B,33B 'refus':4A,54B,68B,123C,148C 'relationship':129C,173C 'request':7A,55B,97C,121C 'restart':61B,143C 'restor':136C 'run':65B 'save':9A,45B,109C,140C 'set':6A,39B,96C 'stack':35B 'start':108C 'state':51B,113C 'still':8A,57B,139C 'suit':92C 'take':80B 'use':146C,158C,168C 'volatil':105C","nicknames":[],"mitigations":[],"who_affected":"Industrial devices that embed the P-Net stack and accept Profinet DCP Set requests from the local network while an Application Relationship is active. Devices with no Profinet DCP exposure on the local segment, or without an active Application Relationship, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","high","industrialdevices","package","pnet","profinet"],"campaign_type":null,"search_a":"'-124761':15A,18A '-2026':14A,17A 'address':12A 'cve':13A,16A 'dcp':5A 'ip':11A 'net':3A 'new':10A 'p':2A 'p-net':1A 'refus':4A 'request':7A 'save':9A 'set':6A 'still':8A","search_b":"'address':41B,69B,83B 'break':72B 'chang':42B 'check':48B 'communic':74B 'configur':46B 'control':73B 'copi':36B 'dcp':38B 'devic':22B,34B,50B,63B 'embed':19B 'host':79B 'industri':21B,32B 'industrial-devic':20B 'ip':40B 'let':76B 'nearbi':78B 'net':25B,30B 'p':24B,29B 'p-net':23B,28B 'packag':26B 'persist':58B 'profinet':27B,33B 'refus':54B,68B 'request':55B 'restart':61B 'run':65B 'save':45B 'set':39B 'stack':35B 'state':51B 'still':57B 'take':80B","search_c":"'1.0.4':88C 'access':166C 'activ':131C,175C 'address':149C,160C 'adjac':164C 'answer':153C 'applic':128C,172C 'check':118C 'configur':106C,133C 'control':155C 'copi':89C 'current':100C 'dcp':95C 'devic':116C,145C 'exampl':125C 'host':162C 'ip':91C 'may':151C,157C 'net':86C 'network':165C 'non':104C 'non-volatil':103C 'p':85C 'p-net':84C 'refus':123C,148C 'relationship':129C,173C 'request':97C,121C 'restart':143C 'restor':136C 'save':109C,140C 'set':96C 'start':108C 'state':113C 'still':139C 'suit':92C 'use':146C,158C,168C 'volatil':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T14:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124761","severity":null,"published_at":"2026-11-13T14:17:50+00:00","modified_at":"2026-11-13T14:17:50+00:00","first_seen_at":"2026-11-13T15:19:49+00:00","fetched_at":"2026-11-13T15:19:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}