---
id: "CVE-2026-124761"
page: "https://infrastack.ai/live/CVE-2026-124761"
kind: "vulnerability"
aliases: ["CVE-2026-124761"]
title: "P-Net: refused DCP Set request still saves new IP address"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded", "industrial-devices", "p-net", "package", "profinet"]
not_affected_if: ["no-profinet-dcp-exposure", "p-net-1.0.4-or-later"]
published_at: "2026-11-13T14:17:50+00:00"
first_seen_at: "2026-11-13T15:19:49+00:00"
updated_at: "2026-11-13T15:21:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124761", "first_seen_at": "2026-11-13T15:19:49+00:00"}]
exploit_sources: []
---

# P-Net: refused DCP Set request still saves new IP address

Link for people: https://infrastack.ai/live/CVE-2026-124761 (this .md is for agents)

P-Net, an industrial Profinet device stack, copies a DCP Set IP address change into its saved configuration before checking the device state, so a refused request is still persisted. After a restart the device can run on the refused address, which can break controller communication or let a nearby host take over its address.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the P-Net version the device firmware embeds; unknown if the sources do not say which products ship it.
- Look for an active Application Relationship on the device while a DCP Set request is possible from the local network.

## Fix

- P-Net: move to `1.0.4` or later (per the advisory's 'before 1.0.4' range).

## Timeline

- 2026-11-13T15:19:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124761

## From the sources

P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_